Binance revealed that investigators uncovered additional breach points in the approximately $6 billion hack, expanding beyond the initially suspected compromised DevOps engineer's laptop. The exchange has not disclosed the nature of these additional breach points.
In an earlier security update on October 30, Binance said its preliminary investigation identified a potentially compromised DevOps engineer's laptop that may have allowed an attacker to access an internal service container and initiate unauthorized withdrawals.
Technical Details of the Attack
According to blockchain intelligence firm TRM Labs, attackers transferred about $6 billion from Binance-associated wallets across 10 blockchains, including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger. Most of the assets were moved within approximately 20 minutes.
TRM Labs found that attackers began preparing at least 36 hours before executing the theft, conducting preliminary transactions and deploying malicious code. On Ethereum, the attacker used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract, utilizing 50 pre-signed authorizations to drain assets.
Binance said it found no evidence of wallet private-key leakage and that wallets on other blockchains executed ordinary transactions bearing valid signatures. The coordinated transactions across different networks pointed to a possible compromise of Binance's hot-wallet signing infrastructure.
Response and Asset Recovery
Binance revoked the affected address authorization and said it is overhauling its withdrawal infrastructure. The exchange froze approximately $3 billion in affected assets through cooperation with blockchain partners and pledged to cover all losses using its Secure Asset Fund for Users and corporate resources.
In its October 30 update, Binance said deposits remained unaffected and that it expected withdrawals to resume in 45 hours. The exchange also plans to publish an updated proof of reserves after remediation.
Links to North Korean Hacking Group
TRM Labs said it was highly confident that TraderTraitor, a North Korea-linked hacking group previously implicated in the $1.5 billion Bybit exploit in February 2025, was responsible for the Binance attack. The firm cited blockchain activity and similarities in the attack's preparation and use of pre-signed authorizations.
Blockchain investigator ZachXBT reported that funds stolen during the Binance exploit and September's approximately $388 million Bitget hack commingled at the same Ethereum address after passing through THORChain, suggesting the same actor may have been responsible for both attacks.
Blockchain security firm MistTrack identified another connection, reporting that stolen TRX tokens from Binance passed through Bitget Wallet's cross-chain bridge before reaching an Ethereum address previously linked to the Phemex hacker.
Binance has not yet confirmed the attackers' identities and said it is cooperating with law enforcement and blockchain intelligence firms to trace the stolen assets.
