Investigators Trace $6.36 Billion Binance Theft to Signing Infrastructure
What happened: Investigators reported that attackers stole $6.
What happened: Investigators reported that attackers stole $6.36 billion across 10 blockchains in approximately 20 minutes, beginning around 20:05 UTC on October 29; TRM Labs attributed the attack to North Korea's TraderTraitor group, with Chainalysis and Elliptic concurring on the North Korean attribution. The supplied reporting describes a compromised DevOps laptop leading to unauthorized service-container access, rather than a private-key leak, and the use of Ethereum's EIP-7702 with 50 pre-signed authorizations to turn a hot wallet into a sweeper. Binance co-CEO Richard Teng cautioned that the incident was more complex than compromised permissions belonging to one employee.
Why it matters: The reported sequence makes authorization infrastructure central to the investigation: protecting private keys alone would not address every failure described here. Attackers also reportedly converted $325 million in stablecoins into $285 million in ETH within 20 minutes to evade freezes, demonstrating why response speed matters after signing controls fail. Attribution identifies the suspected actor, but the operational question for exchanges is how unauthorized instructions reached systems capable of moving funds across those chains.