Binance Finds More Breach Points in the 6 Billion USD Hack as Investigators Link the Theft to North Korea and Earlier Exchange Exploits

The 6 billion USD Binance hack keeps getting worse with every update. The exchange now says investigators have uncovered additional breach points beyond the compromised DevOps laptop it initially suspected, while blockchain intelligence firm TRM Labs has attributed the entire operation to North Korea’s TraderTraitor group. Separately, on-chain sleuths have traced stolen funds commingling with assets from the Bitget and Phemex hacks, suggesting a single actor may be running a months-long hacking campaign against the world’s largest exchanges.

What Binance has confirmed so far

In its October 30 security update, Binance said its preliminary investigation identified a potentially compromised DevOps engineer’s laptop that may have allowed an attacker to access an internal service container and initiate unauthorized withdrawals. Hours later, the exchange disclosed that investigators had found additional breach points, though it declined to specify what they were. Binance maintains it has found no evidence of wallet private-key leakage.

According to TRM Labs’ October 29 investigation, attackers transferred approximately 6 billion USD from Binance-associated wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger, moving most of the assets within about 20 minutes. The preparation began at least 36 hours earlier, with preliminary transactions and malicious code deployed before the main theft.

The technical anatomy of the attack

The most alarming detail is on Ethereum. TRM found that the attacker used EIP-7702, the account-abstraction feature that lets a wallet delegate control to a smart contract, to hand a Binance hot wallet over to a malicious contract. The operation involved 50 pre-signed authorizations, one of which allowed the attacker to install transaction-execution instructions and drain the wallet’s assets.

On other blockchains, the stolen-fund transactions carried ordinary valid signatures. TRM says the coordination across ten different networks and signing systems points to a possible compromise of Binance’s hot-wallet signing infrastructure itself, not a single key failure. If confirmed, that would explain how one operation moved billions across so many chains in minutes.

Binance says it has revoked the affected address authorization and is overhauling its withdrawal infrastructure. The exchange has frozen roughly 3 billion USD in affected assets through cooperation with blockchain partners and has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate resources. Deposits remain unaffected, and Binance expects withdrawals to resume within 45 hours of its latest update, with a refreshed proof of reserves to follow.

North Korea and a trail of overlapping hacks

TRM Labs says it is highly confident the attack was carried out by TraderTraitor, the North Korea-linked group previously implicated in the 1.5 billion USD Bybit exploit of February 2025. The firm cited similarities in attack preparation, use of pre-signed authorizations, and movement of stolen assets.

The on-chain evidence points the same direction. Investigator ZachXBT reported that funds from the Binance theft and September’s roughly 388 million USD Bitget hack converged at the same Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, after passing through THORChain. His conclusion: the same actor was likely behind both incidents, and the Bitget exploit had previously been attributed to TraderTraitor.

Blockchain security firm MistTrack identified another thread. Stolen TRX tokens passed through Bitget Wallet’s cross-chain bridge before landing at an Ethereum address, 0xCd684D22E8C3600E6eE93B5a57923c3b517f3396, previously linked to the Phemex hacker’s laundering trail. The picture that emerges is of a single, well-resourced operation striking exchange after exchange and recycling the same laundering infrastructure.

What this means for everyday crypto users

For Binance customers, the immediate message from the exchange is that losses will be covered and funds are safe, but the incident is a reminder that even the largest, most sophisticated platforms can suffer deep infrastructure compromises. The 45-hour withdrawal pause is the practical pain point, and the promised post-remediation proof of reserves will be worth watching.

The broader lesson extends well beyond Binance. The EIP-7702 delegation vector shows that smart-account features create new attack surfaces for custodians, and the signing-infrastructure angle suggests operational security, not key generation, may be the weakest link at scale. For anyone holding significant crypto, the oldest advice remains the best: keep long-term holdings in self-custody, and treat exchange balances as convenience, not vault storage.

For the industry, a 6 billion USD theft attributed to North Korean hackers with links to at least three prior exchange breaches guarantees regulatory consequences. Lawmakers who have spent the year debating custody rules now have the starkest possible case study, and exchanges will face harder questions about hot-wallet architecture in the months ahead.