Ethical Hacking News
The crypto world was left reeling when Binance, one of the largest cryptocurrency exchanges in the world, reported a staggering $6.3 billion heist in October 2026. This unprecedented breach, which unfolded across 10 blockchains in a matter of minutes, has left investigators and experts scrambling to understand the intricacies of the attack. In this article, we will delve into the details of the hack, exploring the role of North Korea's TraderTraitor hacking group, the Ethereum upgrade that enabled the attacker, and the implications for the cryptocurrency industry.
The Binance exchange was hacked for $6.3 billion, with the attack unfolding across 10 blockchains in a matter of minutes. The hack was carried out using an Ethereum upgrade called EIP-7702, which allowed the attacker to compromise Binance's Ethereum hot wallet. The attacker used a smart contract to drain approximately 167,464 ETH, worth around $1.6 billion in USDT, in a single transaction. The attack is believed to be linked to North Korea's TraderTraitor hacking group, a state-sponsored hacking group. The hack highlights the importance of understanding the technical nuances of blockchain technology and the need for experts to monitor the crypto landscape for potential threats. The attack raises concerns about the security of cryptocurrency exchanges and the need for users to be cautious when using blockchain technology. The true loss from the hack is likely less than the $4.3 billion in penalties Binance agreed to pay as part of its 2023 settlement with the U.S. Department of Justice.
The crypto world was left reeling when Binance, one of the largest cryptocurrency exchanges in the world, reported a staggering $6.3 billion heist in October 2026. The unprecedented breach, which unfolded across 10 blockchains in a matter of minutes, has left investigators and experts scrambling to understand the intricacies of the attack. In this article, we will delve into the details of the hack, exploring the role of North Korea's TraderTraitor hacking group, the Ethereum upgrade that enabled the attacker, and the implications for the cryptocurrency industry.
At the heart of the hack was an attack on Binance's Ethereum hot wallet, which was compromised using an Ethereum upgrade called EIP-7702. EIP-7702, introduced in May 2025, allows ordinary Ethereum wallets to temporarily delegate their behavior to a smart contract, enabling features like token approvals and transfers. In this case, the attacker used EIP-7702 to turn Binance's Ethereum hot wallet into a wallet running an attacker-controlled sweeper contract. This contract allowed the attacker to drain approximately 167,464 ETH, worth around $1.6 billion in USDT, in a single transaction.
The attacker's plan was to submit 50 EIP-7702 authorizations, each signed by Binance 14, and tied to different consecutive nonces. The attacker could not know which nonce would be current when the authorization transaction was processed, so it prepared 50 different possibilities beforehand. One of those turned out to be a match, allowing the attacker to access the sweeper contract and execute the heist.
But how did the attacker gain access to Binance's Ethereum hot wallet in the first place? Investigators have linked the attack to North Korea's TraderTraitor hacking group, a state-sponsored hacking group also associated with the broader Lazarus Group. The attack is believed to have started with a compromised DevOps engineer's laptop, which gave the attacker access to a service container and submission of unauthorized withdrawal transactions.
The implications of this attack are far-reaching. While Binance has assured users that their funds are safe and will be covered through the company's Secure Asset Fund for Users (SAFU) and other company funds, the specifics of how the attacker obtained enough authority to produce valid signatures across multiple blockchains remain unclear. Binance's promised postmortem will need to explain not only the compromised laptop, but the additional breach points and the controls that failed to stop withdrawals worth billions of dollars.
Moreover, the use of EIP-7702 in this attack highlights the importance of understanding the technical nuances of blockchain technology. While EIP-7702 itself is not broken, it can be exploited in clever ways to facilitate attacks. Experts warn that users should be cautious when using wallets that support EIP-7702, as the feature can be used to create complex smart contracts that may pose security risks.
The Binance hack has also drawn comparisons to the previous FTX collapse, but the circumstances around this incident, at least as they are currently understood, appear quite different. There is no public evidence that this was an inside job or that Binance is insolvent. The true loss from the hack is likely less than the $4.3 billion in penalties Binance agreed to pay as part of its 2023 settlement with the U.S. Department of Justice.
In conclusion, the $6.3 billion Binance hack is a stark reminder of the ongoing cat-and-mouse game between hackers and cryptocurrency exchanges. As the crypto industry continues to evolve, it is essential for users to stay informed about the latest security measures and to be cautious when using blockchain technology. The use of EIP-7702 in this attack highlights the importance of understanding the technical nuances of blockchain technology, and the need for experts to continue monitoring the crypto landscape for potential threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Sophisticated-Heist-A-Detailed-Analysis-of-the-63-Billion-Binance-Hack-ehn.shtml
https://gizmodo.com/how-hackers-stole-6-3-billion-from-binance-in-minutes-2000833158
https://www.moneycontrol.com/world/6-3-billion-stolen-in-20-minutes-how-hackers-pulled-off-the-binance-heist-and-why-north-korea-is-suspected-article-14064515.html
https://www.cisa.gov/sites/default/files/publications/AA22-108A-TraderTraitor-North_Korea_APT_Targets_Blockchain_Companies.pdf
https://www.firstpost.com/explainers/who-is-tradertraitor-north-korean-hackers-behind-6-3-billion-binance-hack-14056556.html
https://en.wikipedia.org/wiki/Lazarus_Group
https://deepstrike.io/blog/lazarus-group
Published: Fri Oct 30 15:42:42 2026 by llama3.2 3B Q4_K_M
