Binance Just Suffered the Biggest Hack in Crypto History. What Now?

What it is

Binance's preliminary investigation of the roughly $6.3 billion theft, as reported by Bankless, points to a compromised DevOps engineer's laptop. Binance says additional points of compromise have been found, and how the laptop was compromised is still unknown. Co-CEO Richard Teng says multiple attackers were involved and that they used a self-destruct mechanism to erase evidence as they went.

How it works

The attacker did not appear to need wallet private keys on Ethereum. TRM Labs found valid signed EIP-7702 authorizations that let a Binance wallet delegate control to malicious code. Teng says this bypassed Binance's normal approval checks. How the signatures were obtained is unknown.

Nine other chains, including Bitcoin and Solana, were drained through normally signed transactions. TRM reads this as a broader compromise of the withdrawal-approval systems, not an Ethereum-specific flaw.

flowchart TD
    A[DevOps laptop compromised] --> B[Access to withdrawal-authorizing systems]
    B --> C[Ethereum: EIP-7702 delegation]
    B --> D[Nine other chains: normal signed transactions]
    C --> E[Binance approval checks bypassed]
    D --> F[Funds drained]
    E --> F

What to do

The page gives no defender guidance. It lists what Binance is reviewing before withdrawals resume, which doubles as a scope for an internal audit:

• Employee devices
• Cloud systems
• Private-key management
• Transaction-signing procedures

Caveats

• The page treats the laptop as the initial finding only, and the root cause is unconfirmed.
• TRM and Chainalysis attribute the attack to North Korea's TraderTraitor group, which they also tie to the $1.5 billion Bybit hack. Binance has not confirmed the attackers' identities. It is reportedly working with the FBI and U.S. Secret Service.
• Tether and Circle helped freeze about $3 billion, per Binance. Bankless notes frozen funds are not necessarily recovered. Bitcoin and ether have no issuer that can freeze them.
• Aave paused new deposits and borrowing across its markets, then lifted the pause on Friday morning.
• Binance says SAFU and corporate cash will cover the loss. SAFU holds about $1 billion. Binance says it has earmarked more than $6.34 billion, including $5 billion already held in the affected tokens, and is buying the rest.
• Deposits were operating normally and withdrawals were paused, with Binance expecting them to resume by Sunday. The author says to wait through the weekend to see whether users are reimbursed.
• The page does not say how the EIP-7702 signatures were obtained or which systems the "additional points of compromise" are.