Binance faces $6.3 billion crypto theft across 11 blockchains

Hackers stole an estimated $6.3 billion in cryptocurrency from Binance wallets on Oct. 29, in a theft that hit assets across 11 blockchains. The exchange says it will cover customer losses, while crypto firms and token issuers work to freeze or recover funds.

The attack used Binance’s own transaction systems to move assets from its hot wallets, which are connected to the internet. Blockchain analytics firm Elliptic says its analysis found that on Ethereum, the attacker used EIP-7702, a feature that lets a regular wallet delegate some behavior to a smart contract. The contract then moved funds out of the Binance wallet. Think of it as getting an authorized account to follow new instructions; the wallet’s cryptography itself was not necessarily broken.

How did the attacker get funds out of Binance wallets?

Elliptic’s analysis of the Binance theft says the attacker prepared a “sweeper” contract and submitted a transaction with 50 authorizations signed by the key for Binance’s hot wallet known as Binance 14. The authorizations covered different transaction counts, so one could match the wallet’s current count when the transaction landed.

That let the contract take control of the wallet’s transaction behavior and drain it. Elliptic says the wallet lost 167,464 ether and 63 tokens, including USDT. The attacker also moved assets from Binance wallets on other chains, including XRP Ledger, Solana, Bitcoin, Tron and Avalanche. Elliptic’s estimate is $6.43 billion; Binance has put the impact at about $6.3 billion.

Binance initially said a compromised DevOps engineer’s laptop may have given an attacker access to a service container used to submit unauthorized withdrawals. Elliptic says Binance later reported finding additional breach points and called the incident a complex attack. The exact route into the systems has not been disclosed.

Can the stolen crypto be frozen or recovered?

Some tokens can be frozen by their issuers, but bitcoin and ether have no central issuer with that power. Elliptic says Tether and Circle froze funds held in attacker-controlled addresses, while other token issuers and blockchain networks also acted. It had verified $2.85 billion in frozen or seized assets by Oct. 31. Binance told TechCrunch that industry partners had frozen about $3 billion and that it had begun recovering affected assets.

The exchange said it would cover all losses using its Secure Asset Fund for Users and company funds. Elliptic reports that Binance had reserved more than $6.34 billion, including $5 billion in the same tokens that were stolen. Binance said it would publish updated proof-of-reserves data after remediation.

Who does the evidence point to?

Blockchain researchers have pointed to TraderTraitor, a hacking group linked to North Korea. Elliptic said the evidence made that attribution likely, but no government or law enforcement agency had confirmed responsibility as of Oct. 31. Binance’s co-CEO Richard Teng said the company’s investigation had not attributed the attack to an individual.

TechCrunch’s report on Binance’s response said deposits and withdrawals were suspended during the investigation. The theft’s scale is striking, but its immediate consequence for customers turns on two practical questions: how much of the crypto can be frozen, and whether Binance’s reserves can cover losses while it restores service.

Source material

• analysis of the Binance theft — elliptic.co