Skip to main content
Merkle Street

Protocols, markets, policy, people

FBI ties $6.34 billion Binance theft to North Korea

The FBI attributes Binance’s October 29 theft of more than $6 billion to North Korea’s TraderTraitor, while Binance says an internal signing service was abused.

Merkle Street Newsroom#9790bd3 min read

FBI ties $6.34 billion Binance theft to North Korea

North Korean hackers stole about $6.34 billion in digital assets from Binance on October 29, according to the FBI and the exchange, in a breach that bypassed Binance’s normal withdrawal process. The FBI identifies the activity as TraderTraitor and says the attackers are moving stolen assets into Ether and are expected to use decentralized finance and instant-swap services to launder them. Binance’s initial incident report describes how the attackers reached its wallet-signing system.

How did the attackers get transactions signed?

Binance says the attackers gained access to an internal wallet-signing service and used it to start transactions outside the normal withdrawal process. The service is the part of the system that authorizes a hot wallet to send assets. Binance reported that five hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC. Wallets on Solana and Optimism also sent about 970,500 SOL and 44.2 million OP.

The attackers then used the signing service to apply Ethereum’s EIP-7702 authorization mechanism. EIP-7702 lets an account delegate some execution rights to a smart contract without revealing its private key. Binance says the attackers used it to give a contract they controlled partial execution rights over a hot wallet. Like getting a temporary permission slip signed for a vault, this gave the contract authority to move assets without exposing the vault’s key.

Why didn’t suspending withdrawals stop the transfers?

Binance says the on-chain authorizations already in place could keep moving assets independently of its usual withdrawal system. The exchange suspended withdrawals and worked to revoke the permissions, but its hot wallets use multi-party computation, or MPC: several parties hold parts of the signing process instead of one person holding a complete private key. Binance said this made revoking the authorizations more complex. Its report says the final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC; the exchange cleared the delegation code at 00:10 UTC on October 30.

What has the FBI said, and what can still be recovered?

The FBI’s October 31 alert says North Korea was responsible for stealing more than $6 billion from Binance. It reports that investigators have seen the attackers converting assets primarily into Ether, and asks crypto services to block transactions linked to listed addresses.

Binance said on November 3 that about $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes. It also said it would cover the loss and had replenished 98% of affected token assets as of October 31. Its investigation is ongoing, and it said the findings would receive further independent review.

Source material