Binance Reveals Additional Breach Points in $6 B Hack Linked to North Korean Group

Binance investigators have identified new attack vectors beyond an initially suspected compromised employee laptop in the roughly $6 billion theft. The exchange has not disclosed the extra breach points but confirmed that no wallet private‑key leakage occurred. TRM Labs attributes the incident to the North Korean‑linked group TraderTraitor, which also targeted Bybit in February 2025. Attackers moved the stolen funds across ten blockchains—Ethereum, Bitcoin, Tron, Solana, XRP Ledger, and others—within about 20 minutes, using EIP‑7702 to delegate control of a Binance hot wallet to a malicious contract. The operation involved 50 pre‑signed authorizations, one of which allowed the attacker to install transaction‑execution instructions and drain assets. Binance froze roughly $3 billion of the affected assets, pledged to cover all losses via its Secure Asset Fund for Users (SAFU) and corporate resources, and plans to resume withdrawals in about 45 hours while overhauling its withdrawal infrastructure. The incident highlights coordinated cross‑chain theft and potential compromise of Binance’s hot‑wallet signing infrastructure.