The Federal Bureau of Investigation (FBI), in cooperation with the U.S. Secret Service (USSS) and the Internal Revenue Service-Criminal Investigation (IRS-CI), has officially attributed the massive hack against the Binance platform to TraderTraitor, a state-sponsored North Korean hacker group. This incident is recorded as the largest cryptocurrency theft in history, with losses estimated at approximately $6.3 billion.
The attack occurred on October 29, when the attackers managed to drain the platform's hot wallets across multiple blockchains, transferring most of the funds in just 20 minutes. The FBI identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address associated with the stolen funds, calling on blockchain analysis firms and decentralized finance (DeFi) platforms to reject any transactions linked to these addresses.
Advanced Technical Vulnerabilities and Self-Destruct Mechanism
Subsequent investigations by Binance revealed that the attack was far more complex than initially thought. While preliminary estimates suggested a potential compromise of a DevOps engineer's laptop, Richard Teng, Co-CEO of Binance, confirmed that the attack involved additional entry points. Among the prominent technical details observed was the attackers' exploitation of the EIP-7702 delegation feature on the Ethereum network, which allowed them to bypass the platform's standard approval controls.
Additionally, the attackers used a "self-destruct" mechanism to erase the tools used and digital evidence, increasing the difficulty of tracking and digital forensic investigations.
What Changes Practically?
The danger of this attack lies in the shift from traditional human-driven money laundering patterns to fully automated patterns. According to blockchain analytics firm Elliptic, the stolen funds are being moved by "never-sleeping" systems, with core wallets continuing to distribute funds around the clock and on a regular basis.
- Automation vs. Humans: Unlike the Bybit attack in February 2025 which followed human operational patterns, Binance's funds are being moved through automated systems that may rely on scripts or even AI agents, though it is not technically possible to confirm this yet.
- Bypassing Restrictions: The system demonstrated the ability to reroute funds through new wallets immediately upon the rejection of any cross-chain bridge to accept deposits.
- Tracking Complexity: The use of instant exchange services and decentralized finance (DeFi) makes freezing or recovering assets extremely difficult.
Binance's Commitment to Compensation
For its part, Binance affirmed its full commitment to covering all losses, noting that it has already replaced about 95% of the stolen amount using the company's own funds. The platform has begun a gradual process to resume withdrawals, starting with the Bitcoin network, with a promise to provide a detailed post-mortem technical report once all technical facts regarding the additional breach points are verified.