Yesterday’s exploit on Binance went down in crypto history with roughly $6.3B stolen, it is the largest theft ever recorded. Binance confirmed that the attack hit multiple assets, including BTC, ETH, XRP and USDT.

The internal investigation is still ongoing, but Binance suspects a DevOps engineer's laptop compromised through the execution of an EIP-7702 batch sent by the attacker with 50 pre-signed authorizations (nonce n to n+49), in order to slip the execution of the unverified contract that opened access to the attacker into the constant transaction flow.

Binance reports roughly $3B in frozen assets, including $1.567B in USDT and more than $800M in USDC.

This exploit has been linked to an address tied to the Bitget exploit, or to the Kelp DAO exploit, both of which were attributed to the Lazarus Group (DPRK), suggesting they are also involved in this Binance exploit.

Despite the exploit, the impact on users appears limited, as Binance’s reserves were only modestly affected. Within the same block interval, 18,279 BTC, 185M XRP and $1.67B in USDT were pulled from the platform. ETH left in two waves, 167,464 ETH then 79,376 ETH, for a total of 246,840 ETH.

Still, reserves moved only moderately over the day :

BTC : -3.1%, to over 682,000 BTC

ETH : -8.5%, to 3.3M ETH

XRP : -8%, to 2.47B XRP

USDT : -6.3%, to 34.1B USDT

Even though the scale of this exploit is unprecedented, Binance’s reserves do not suggest that the impact on the platform was that severe, which allows it to absorb the blow and spare its users from being affected as much as possible.

Binance has also pledged to cover losses with its SAFU fund and company reserves.

Written by Darkfost