Binance said investigators uncovered additional breach points in the approximately $6 billion hack after initially suspecting a compromised employee laptop. The exchange has not disclosed what those additional breach points were.
In an earlier Oct. 30 security update, the exchange said its preliminary investigation identified a potentially compromised DevOps engineer’s laptop that may have allowed an attacker to access an internal service container and initiate unauthorized withdrawals.
The disclosure comes as blockchain intelligence firm TRM Labs attributed the incident to North Korea-linked TraderTraitor, while independent investigators identified connections between the stolen funds and previous attacks on Bitget and Phemex.
Binance investigates withdrawal infrastructure
Binance said it found no evidence of wallet private-key leakage.
According to TRM Labs’ Oct. 29 investigation, attackers transferred about $6 billion from Binance-associated wallets across 10 blockchains, moving most of the assets within about 20 minutes.
The affected networks included Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger.
TRM found that the attackers began preparing at least 36 hours before executing the theft, conducting preliminary transactions and deploying malicious code before the main withdrawals.
On Ethereum, TRM said the attacker used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract.
The operation involved 50 pre-signed authorizations, one of which allowed the attacker to install transaction-execution instructions and subsequently drain assets from the wallet.
TRM said wallets on other blockchains executed ordinary transactions bearing valid signatures. It said the coordinated transactions across different networks and signing systems pointed to a possible compromise of Binance’s hot-wallet signing infrastructure.
Binance said it had revoked the affected address authorization and was overhauling its withdrawal infrastructure.
The exchange also said it had frozen approximately $3 billion in affected assets through cooperation with blockchain partners and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate resources.
In its latest Oct. 30 update, Binance said deposits remained unaffected and that it expected withdrawals to resume in 45 hours. The exchange also plans to publish an updated proof of reserves after remediation.
North Korea links emerge as stolen funds overlap with earlier hacks
While Binance investigates the technical failure, blockchain researchers have identified evidence that may link the incident to a series of earlier attacks attributed to North Korean hackers.
TRM Labs said it was highly confident that TraderTraitor, a North Korea-linked hacking group previously implicated in the $1.5 billion Bybit exploit in February 2025, was responsible for the Binance attack.
The firm cited a combination of blockchain activity and off-chain intelligence, including similarities in the attack’s preparation, use of pre-signed authorizations, and movement of stolen assets.
Blockchain investigator ZachXBT reported that funds stolen during the Binance exploit and September’s approximately $388 million Bitget hack commingled at the same Ethereum address.
According to ZachXBT, funds from both incidents converged at address 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 after passing through THORChain.
He suggested that the overlap indicated the same actor was likely responsible for both attacks, noting that the Bitget exploit had previously been attributed to TraderTraitor, which was also linked to the Kelp DAO incident.
Blockchain security firm MistTrack separately identified another connection involving assets stolen from Binance.
The firm reported that stolen TRX tokens passed through Bitget Wallet’s cross-chain bridge before reaching an Ethereum address previously linked to the Phemex hacker.
MistTrack traced the funds to address 0xCd684D22E8C3600E6eE93B5a57923c3b517f3396, which it said had appeared in the laundering trail associated with the earlier Phemex exploit.
Binance has not yet confirmed the attackers’ identities and said it is cooperating with law enforcement and blockchain intelligence firms to trace the stolen assets.