Binance hit by $6.3bn theft as investigators trace signing breach

Binance, the world’s largest cryptocurrency exchange, said attackers drained about $6.3 billion from its transaction wallets on Oct. 29, in what blockchain analysts describe as the largest crypto theft on record. Reuters’ account of the attack says most of the theft unfolded in about 20 minutes.

The breach puts the security of exchange withdrawal systems under scrutiny, while the mix of stolen assets affects how much can be frozen or recovered.

Binance initially said its investigation pointed to a compromised DevOps engineer’s laptop, which may have let an attacker access a service container and submit unauthorized withdrawals. The exchange said it found no evidence that wallet private keys had leaked. It later reported additional breach points, without publicly detailing them.

How did attackers get withdrawals approved?

Elliptic’s analysis of the Binance theft puts the total at $6.43 billion across 11 blockchains and says the evidence points to compromised signing infrastructure. On Ethereum, the attacker used EIP-7702 delegation to assign a sweeper contract control of the Binance 14 hot wallet. The contract then moved 167,464 ETH and 63 tokens, including 1.6 billion USDT, from that wallet. Elliptic says the delegation persisted, enabling further withdrawals without new signatures.

Other affected chains saw withdrawals in signed transactions. Elliptic says the scale and timing of the transfers suggest attackers were able to instruct Binance’s signing systems. The exchange has said its investigation is ongoing and has not explained the additional breach points it found.

How much of the stolen crypto was frozen?

Elliptic verified $2.85 billion in frozen or seized assets by Nov. 1, about 44% of its estimated theft total. The frozen funds were mostly USDT and USDC: their issuers can blacklist tokens at specific addresses. Bitcoin and ether have no central issuer that can freeze them, so recovery depends on tracing those assets to services able to block or seize them.

That distinction leaves a substantial portion harder to contain. Binance said it was working with law enforcement, issuers and blockchain partners to trace and freeze funds. Elliptic reported that the attacker was converting some remaining tokens into ether and moving assets between chains.

Who does the FBI say was responsible?

On Oct. 31, the FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group, according to Elliptic. Earlier, Binance and blockchain analysts had not publicly confirmed who was behind the attack; investigators had pointed to similarities with operations attributed to North Korean hackers.

Binance said it would cover customer losses using its Secure Asset Fund for Users and company funds. Elliptic reported that the exchange began reopening withdrawals on Nov. 1, starting with the Bitcoin network.

Sources

• Reuters’ account of the attack — investing.com
• analysis of the Binance theft — elliptic.co