Unraveling the $6.3 Billion Binance Crypto Heist
On October 31, the U.S. FBI announced its investigation findings: the theft of approximately $6.3 billion from Binance was carried out by TraderTraitor, a North Korean-linked hacking group. TRM Labs and Chainalysis reached the same conclusion.
The group is a branch of the Lazarus Group and was previously responsible for the $1.5 billion Bybit heist. These findings are based solely on institutional investigations, not a court ruling. North Korea has not yet responded.
In the early hours of October 30 Beijing time, several Binance hot wallets were attacked. Within just tens of seconds, assets worth about $6.3 billion were transferred across multiple blockchains, setting a new industry record for stolen funds. The attack primarily targeted Ethereum wallets. The hackers used the EIP-7702 authorization mechanism to transfer assets; they did not steal private keys.
The hackers compromised devices belonging to the platform’s operations staff and obtained internal access to initiate transfers. After the incident, stablecoin issuers urgently froze about $3 billion in stolen funds. The hackers laundered the rest across chains using DeFi and mixing services. The FBI publicly released addresses and called on others to help intercept the funds.
Binance immediately suspended all withdrawals and pledged to cover losses using its SAFU fund, then gradually resumed withdrawals across its networks. TraderTraitor has long targeted crypto exchanges and is adept at obscuring the trail of funds after a successful attack, making investigations difficult. So far, only a limited amount of the funds has been frozen, and tracking the remaining stolen assets is difficult. It will take time for the incident to be definitively classified.
$BNB
On October 31, the U.S. FBI announced its investigation findings: the theft of approximately $6.3 billion from Binance was carried out by TraderTraitor, a North Korean-linked hacking group. TRM Labs and Chainalysis reached the same conclusion.
The group is a branch of the Lazarus Group and was previously responsible for the $1.5 billion Bybit heist. These findings are based solely on institutional investigations, not a court ruling. North Korea has not yet responded.
In the early hours of October 30 Beijing time, several Binance hot wallets were attacked. Within just tens of seconds, assets worth about $6.3 billion were transferred across multiple blockchains, setting a new industry record for stolen funds. The attack primarily targeted Ethereum wallets. The hackers used the EIP-7702 authorization mechanism to transfer assets; they did not steal private keys.
The hackers compromised devices belonging to the platform’s operations staff and obtained internal access to initiate transfers. After the incident, stablecoin issuers urgently froze about $3 billion in stolen funds. The hackers laundered the rest across chains using DeFi and mixing services. The FBI publicly released addresses and called on others to help intercept the funds.
Binance immediately suspended all withdrawals and pledged to cover losses using its SAFU fund, then gradually resumed withdrawals across its networks. TraderTraitor has long targeted crypto exchanges and is adept at obscuring the trail of funds after a successful attack, making investigations difficult. So far, only a limited amount of the funds has been frozen, and tracking the remaining stolen assets is difficult. It will take time for the incident to be definitively classified.
$BNB