Binance initially suspected a compromised employee laptop. TRM separately attributes the attack to North Korea, while investigators trace links to earlier hacks.
Binance said investigators uncovered additional breach points in the approximately $6 billion hack after initially suspecting a compromised employee laptop. The exchange has not disclosed what those additional breach points were.
In an earlier Oct. 30 security update, the exchange said its preliminary investigation identified a potentially compromised DevOps engineer's laptop that may have allowed an attacker to access an internal service container and initiate unauthorized withdrawals.
The disclosure comes as blockchain intelligence firm TRM Labs attributed the incident to North Korea-linked TraderTraitor, while independent investigators identified connections between the stolen funds and previous attacks on Bitget and Phemex.
According to TRM Labs' Oct. 29 investigation, attackers transferred about $6 billion from Binance-associated wallets across 10 blockchains, moving most of the assets within about 20 minutes.
The affected networks included Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger.
TRM found that the attackers began preparing at least 36 hours before executing the theft, conducting preliminary transactions and deploying malicious code before the main withdrawals.
On Ethereum, TRM said the attacker used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract.
The operation involved 50 pre-signed authorizations, one of which allowed the attacker to install transaction-execution instructions and subsequently drain assets from the wallet.
TRM said wallets on other blockchains executed ordinary transactions bearing valid signatures. It said the coordinated transactions across different networks and signing systems pointed to a possible compromise of Binance's hot-wallet signing infrastructure.
Source link
