Binance’s $6.3B wallet breach traced to signing systems

Hackers drained about $6.3 billion from Binance wallets on Oct. 29 in what blockchain analysts say is the largest crypto theft on record. The attack used Binance’s systems for authorizing wallet transactions, according to Reuters’ report on the breach. On Oct. 31, the FBI attributed the theft to North Korea’s TraderTraitor group, according to blockchain analytics firm Elliptic.

How did the attackers get the wallets to send funds?

A crypto wallet uses a private key to authorize transactions. Binance’s signing infrastructure applies those authorizations so its hot wallets can move funds. Elliptic’s analysis suggests the attackers gained a way to make Binance’s systems sign transactions for them; it has not reported that the attackers stole the private keys themselves.

On Ethereum, Elliptic says, the attackers used EIP-7702, a feature that lets a regular wallet delegate actions to a smart contract. They supplied multiple authorizations for Binance’s hot wallet, then used the contract to move funds after the delegation took effect. Think of it as getting the vault’s release system to accept instructions, rather than taking the vault key. Binance initially said a compromised DevOps engineer’s laptop may have played a role. It later said its investigation found additional points of breach and described a complex attack.

Which wallets and networks were affected?

Elliptic’s analysis traced the theft to Binance hot wallets across 11 blockchains. Hot wallets connect to online services so an exchange can process transactions and withdrawals. The bulk of the transfers happened in about 20 minutes, according to Reuters. On Ethereum, Elliptic says, a contract drained one Binance wallet of 167,464 ether and 63 tokens, including USDT. Other affected wallets sent funds in transactions across networks including Bitcoin, Solana, Tron and XRP Ledger.

Binance paused withdrawals, which it said stopped further outflows. The exchange has said it will cover losses and reserved more than $6.34 billion in company funds. Elliptic’s analysis of the attack and fund movements estimated that $2.85 billion had been frozen or seized by Nov. 1, close to Binance’s estimate of roughly $3 billion.

Why could some stolen tokens be frozen?

Some stablecoins have central issuers that can freeze tokens at specific addresses. Bitcoin and ether have no central issuer with that power, so recovery depends on tracking the funds and getting exchanges, brokers or law enforcement to intervene. Elliptic says the FBI named TraderTraitor in its attribution; Binance has said it is working with law enforcement to identify the criminals. The investigation into how the attackers reached Binance’s signing systems is ongoing.

Source material

• Reuters’ report on the breach — investing.com
• analysis of the attack and fund movements — elliptic.co