Binance, the world's largest cryptocurrency exchange, has been hit by the largest heist in the history of digital assets, with losses estimated at approximately $6.36 billion. Blockchain intelligence firms have indicated that the attack was likely carried out by the "TraderTraitor" group, a cyberattack unit backed by the state of North Korea.
Technical Mechanism of the Hack
According to preliminary investigations conducted by Binance, the breach did not result from a leak of private keys, but rather began with the compromise of a laptop belonging to an engineer in the DevOps department. This breach allowed the attackers to gain access to a service container and subsequently submit unauthorized withdrawal transactions.
Analyses by TRM Labs showed that the attackers used highly sophisticated techniques. On the Ethereum network, they exploited the "EIP-7702" mechanism, which allows standard wallets to delegate their behavior to a smart contract via a pre-signed authorization. The attackers sent a batch of 50 pre-signed authorizations from the Binance hot wallet, allowing them to take control of the wallet's behavior and drain it completely within 20 minutes across ten different blockchains.
Links to International Cyberattack Groups
The technical patterns of this attack match previous operations, such as the hack of the Bybit platform in February 2025 and the KelpDAO hack in April 2026. Key features include the use of wallets funded through mixers like Tornado Cash, long-term preparation for the operation, and the pre-collection of digital signatures for simultaneous use.
Companies such as Chainalysis and security experts like ZachXBT have confirmed that the Lazarus Group, linked to North Korea, is the primary suspect. While stablecoin issuers like Tether and Circle have succeeded in freezing approximately $3 billion of the stolen assets, the attackers still control nearly $2.4 billion in ETH and BTC, which are difficult to freeze.
What Does This Hack Change?
This attack represents a dangerous shift in strategies for attacking digital financial infrastructure. Instead of focusing on stealing private keys directly, the attackers targeted the "signing environment" by compromising employee devices and accessing service containers, rendering traditional wallet defenses insufficient. Furthermore, the use of protocols like EIP-7702 highlights a new tool in the hands of attackers to execute complex, automated withdrawals, forcing platforms to reconsider how they secure engineer devices and cross-chain signing systems.