Blockchain analysts have linked the recent breach of Binance, where approximately $6.3 billion was stolen, to North Korea’s Lazarus Group. This event unfolded on October 29, raising concerns over state-sponsored cybercrime.
Summary
- TRM Labs confidently associates the $6.3 billion Binance breach with North Korea’s TraderTraitor hacking unit.
- Ido Ben-Natan, CEO of Blockaid, stated that in less than an hour, over $3.5 billion was transferred across four blockchains.
- The investigation found that the attack was facilitated through compromised transaction-signing processes, particularly involving 50 Ethereum authorizations aimed at a single hot wallet.
- Binance disclosed that roughly $3 billion in assets had been frozen, committing to reimburse affected customers.
- Currently, withdrawals are halted as security measures are implemented, with a timeline for resuming services set at 48 hours.
As per TRM Labs, their team established with high confidence that the breach was executed by TraderTraitor, a hacking group linked to Lazarus. Meanwhile, blockchain investigator ZachXBT also identified Lazarus as a likely perpetrator, although Binance has yet to verify these claims.
In statements to crypto.news, Blockaid CEO Ido Ben-Natan emphasized that this incident eclipsed previous cryptocurrency thefts in magnitude.
“This marks the most significant crypto hack in history. Our analysis shows that at least $3.5 billion was extracted from Binance hot wallets on Ethereum, Arbitrum, Optimism, and Avalanche in less than an hour, more than doubling the theft at Bybit in February 2025,” Ben-Natan explained.
He pointed out that investigators identified more transfers involving Bitcoin and Tron, while his team continued to trace the stolen funds.
On another note, blockchain analytics platform Onchain Lens revealed that the hacker transferred 17,260 ETH, around $38.82 million, to a new wallet, raising fears that the funds could be laundered using Tornado Cash or other mixers.
The tracker indicated that the perpetrator retained nearly 480,720 ETH, equivalent to $1.08 billion, which cannot be frozen by any token issuer. The receiving wallet was identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea.
Lazarus Group Alleged in Binance Hack Spanning Ten Blockchains
According to TRM’s investigation, approximately $6.36 billion departed Binance-controlled wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger.
The majority of the stolen funds were transmitted within about 20 minutes, starting at 20:05 UTC. Around $3.79 billion was moved on Ethereum, with Bitcoin and Tron contributing another $1.47 billion and $628 million, respectively.
Investigation results showed 233.46 million XRP, nearing $296 million, exited five Binance wallets before the Ethereum breaches began.
The security firm reported that the attackers had likely prepared for the theft at least 36 hours prior. They received three small withdrawals from Tornado Cash and tested harmful code before initiating the Binance attack.
TRM connected these activities to TraderTraitor through blockchain transactions and additional intelligence, although specific evidence behind this attribution has not been publicly shared.
Previously, the FBI had identified TraderTraitor as the group behind the February 2025 Bybit breach, in which around $1.5 billion was drained from the platform. U.S. officials have implicated North Korean hacking operations in cryptocurrency thefts to fund the country’s weapons initiatives.
Insights from Blockaid on Wallet Access During Binance Breach
A technical review by Blockaid discovered an unusual Ethereum transaction involving 50 EIP-7702 authorizations directed at Binance 14, one of the exchange’s most active hot wallets.
EIP-7702 permits an Ethereum wallet to authorize smart contract code to act on its behalf. The attacker utilized 50 sequential transaction counters for authorizations, enhancing the probability that one would align with the wallet’s existing counter.
Ultimately, only one authorization succeeded, enabling a malicious contract to withdraw assets from the wallet.
“The attacker effectively reprogrammed a significant Binance Ethereum hot wallet so a single operator could drain it, including any new deposits made into it,” Ben-Natan shared with crypto.news.
The attacker extracted around $2.5 billion from Binance 14, which included 167,464 ETH and over 1.6 billion USDT. Further transfers targeted newly received funds.
Investigators uncovered other Binance wallets transferring assets through standard signed transactions across multiple networks. TRM suspects the attacker exploited the exchange’s transaction-signing infrastructure.
Binance Investigates Possible Laptop Breach Amid $3 Billion in Assets Frozen
In an update regarding security, Binance indicated that preliminary investigations pointed to a compromised DevOps engineer’s laptop that may have enabled unauthorized access to an internal service container.
No evidence of leaked private keys was discovered, and the exchange plans to release a comprehensive report upon determining the cause of the breach.
Tether’s CEO Paolo Ardoino confirmed the freezing of over 1.567 billion USDT, while Circle’s CEO Jeremy Allaire reported freezing over 800 million USDC. Additionally, the Arbitrum Security Council secured around 74.6 million ARB and 8,425 ETH associated with the attacker.
Current Status on Binance Withdrawals
Binance has committed to cover losses using its SAFU fund and company resources while collaborating with law enforcement and blockchain analysts.
While deposits continue to function, the exchange has paused withdrawals as it enhances its withdrawal systems and control measures.
Binance anticipates that withdrawals will recommence in 48 hours and plans to provide a complete report regarding the cause of the attack.
Following the breach, cryptocurrency markets experienced selling pressure, with Bitcoin briefly dipping below $77,000. Over 24 hours, total liquidations in the derivatives market exceeded $1.5 billion.