Finance1 min read

Binance says North Korean hackers stole $6.34 billion funds in a technical breach

By · Published by Everything Blog

In short

Attackers leveraged access to an internal signing service to rapidly siphon diverse cryptocurrencies across several distinct blockchains. The perpetrators maintained operational control over a company wallet even after normal withdrawals were paused by exploiting Ethereum's EIP-7702 delegation mechanism. Meanwhile, Binance has intercepted or frozen roughly $2.85 billion of the haul and allocated full funding to ensure complete customer compensation.

Key points

  • Social engineering campaigns targeting individual staff members pose critical threats to…: Social engineering campaigns targeting individual staff members pose critical threats to centralized cryptocurrency exchange infrastructure.
  • Binance has replenished 98% of the affected token assets and pledged to fully cover all f…: Binance has replenished 98% of the affected token assets and pledged to fully cover all financial losses.
  • Advanced adversaries can exploit specialized protocols like Ethereum delegation mechanism…: Advanced adversaries can exploit specialized protocols like Ethereum delegation mechanisms to maintain illicit control during an active containment response.

Sources checked by our analysis pipeline: 1

The company said it has frozen or intercepted approximately $2.85 billion of the affected assets and will cover the financial losses resulting from the October 29 attack.

In a detailed statement released on November 3, Binance said it had already set aside more than 100% of the funds required to compensate for the losses. As of October 31, the exchange had replenished 98% of the affected token assets, with the remaining purchases involving less liquid cryptocurrencies still underway.

The attack, potentially the largest cryptocurrency theft on record, involved unauthorised access to an internal wallet signing service that allowed hackers to transfer digital assets outside the exchange's normal withdrawal process.

According to Binance, five of its hot wallets transferred 233.46 million XRP to an attacker-controlled address within four minutes on October 29. Other wallets on the Solana and Optimism networks subsequently transferred approximately 970,500 SOL and 44.2 million OP tokens.

Hackers also transferred 18,270 Bitcoin from a Binance hot wallet.

The company said the attackers later exploited Ethereum's EIP-7702 authorisation mechanism, which allows cryptocurrency accounts to delegate certain transaction permissions to…

Finance