North Korean hackers have stolen a staggering $6.36 billion in cryptocurrency from Binance, according to blockchain intelligence firm TRM Labs. On October 29 the attack reportedly drained funds across 10 different blockchains in roughly 20 minutes. TRM attributes the operation to TraderTraitor, a North Korean state-sponsored hacking group.
How did hackers steal $6.3 billion from Binance?
On Ethereum, the hackers exploited a mechanism involving Ethereum’s EIP-7702 standard to hijack a Binance hot wallet and turn it into a contract they fully controlled. They used one of 50 pre prepared authorizations that happened to match the wallet’s transaction count.
Kevin Horvat / Unsplash
On the other nine blockchains, they simply moved funds using ordinary signed transfers. TRM believes Binance’s wallet signing system itself was likely compromised, though Binance has not confirmed exactly how it happened.
The group reportedly started preparing at least 36 hours earlier, running test transactions and funding an operator wallet through small withdrawals from Tornado Cash. TRM Labs says the North Korean hacking group TraderTraitor is also tied to last year’s $1.5 billion Bybit hack, making this one about four times bigger.
The stolen assets included Bitcoin, Ethereum, XRP, Solana, and stablecoins. Binance confirmed the security incident and temporarily suspended withdrawals across several networks. It said user funds were safe, although the investigation is ongoing.
How much of the stolen cryptocurrency has been recovered?
The good news is that companies like Tether, Circle, Ripple, and World Liberty Financial managed to freeze about $2.7 billion of the stolen funds pretty quickly. The bad news is that the hackers still hold around $2.4 billion worth of assets, including over 420,000 ETH and more than 18,000 bitcoin, sitting safely outside anyone’s reach.
Tugay Kocatürk / Pexels
Hackers have already started laundering some of it, selling tokens likely to get frozen to market makers at a discount and routing funds through multiple wallets to cover their tracks. TRM expects the next stage to involve bridges and swap services, so this story is far from over.
The incident highlights how dangerous compromised transaction-signing systems can be for cryptocurrency exchanges. Even with billions frozen, recovering the remaining funds could prove difficult.
RELATED COVERAGE: