🚨 NORTH KOREAN HACKERS LINKED TO THE $6.3B BINANCE THEFT
TRM Labs attributes the attack with high confidence to TraderTraitor—the North Korean hacking group also linked to the February 2025 Bybit theft.
TRM estimates approximately $6.36 billion moved out of Binance wallets across 10 blockchains.
Its assessment calls this the largest crypto theft on record.
How did it happen?
Binance initially pointed to a potentially compromised DevOps laptop, but later disclosed additional breach points.
The full attack sequence remains under investigation.
On Ethereum, TRM identified a transaction containing 50 pre-signed EIP-7702 authorizations.
EIP-7702 allows an ordinary Ethereum account to delegate execution to smart-contract code.
But this was not simply an Ethereum-only incident.
The cross-chain activity points to a broader signing-infrastructure compromise, according to TRM.
Binance says approximately $3 billion has been frozen and that it will cover stolen funds using SAFU and corporate resources.
The distinction matters:
Frozen does not mean recovered.
And a reimbursement commitment does not mean the investigation is finished.
Watch verified recovery updates—not “recovery” links appearing in your DMs.
— Aasim Majeed AMC
$BTC $BNB $ETH
#Binance #CryptoSecurity #Lazarus #Crypto
TRM Labs attributes the attack with high confidence to TraderTraitor—the North Korean hacking group also linked to the February 2025 Bybit theft.
TRM estimates approximately $6.36 billion moved out of Binance wallets across 10 blockchains.
Its assessment calls this the largest crypto theft on record.
How did it happen?
Binance initially pointed to a potentially compromised DevOps laptop, but later disclosed additional breach points.
The full attack sequence remains under investigation.
On Ethereum, TRM identified a transaction containing 50 pre-signed EIP-7702 authorizations.
EIP-7702 allows an ordinary Ethereum account to delegate execution to smart-contract code.
But this was not simply an Ethereum-only incident.
The cross-chain activity points to a broader signing-infrastructure compromise, according to TRM.
Binance says approximately $3 billion has been frozen and that it will cover stolen funds using SAFU and corporate resources.
The distinction matters:
Frozen does not mean recovered.
And a reimbursement commitment does not mean the investigation is finished.
Watch verified recovery updates—not “recovery” links appearing in your DMs.
— Aasim Majeed AMC
$BTC $BNB $ETH
#Binance #CryptoSecurity #Lazarus #Crypto
