Funds drained from hot wallet across 10 blockchains in 20 minutes
FBI points to North Korea-linked TraderTraitor group
Developer laptop, internal service systems may have been compromised
Transaction approval bypass suspected; technical cause still under investigation
Binance has begun restoring withdrawal services three days after hackers stole $6.36 billion worth of virtual assets from the world's largest cryptocurrency exchange. The company said it has covered about 95 percent of the stolen assets using its own funds, though the attack vector and the fate of the remaining assets are still under investigation.
Binance announced Sunday that it would begin allowing withdrawals of major virtual assets — including Bitcoin, Ethereum, BNB, Solana, XRP and Dogecoin — on a rolling basis. The exchange said it plans to expand the range of supported assets as security checks on individual networks and tokens are completed.
The speed and scale of the attack were unprecedented. Blockchain analytics firm TRM Labs said about $6.36 billion was drained from Binance wallets on Thursday across 10 blockchains, with most of the assets moved within roughly 20 minutes. The attack began at approximately 8:05 p.m. Coordinated Universal Time.
In its initial investigation, Binance said a laptop belonging to a DevOps employee may have been compromised, allowing the attacker to access internal service containers and execute unauthorized withdrawal transactions. The co-CEO later said the breach may have extended beyond the laptop initially suspected. Investigators have also raised the possibility that the attacker exploited Ethereum's account delegation feature to take control of the hot wallet and bypass normal transaction approval procedures. The company said it is continuing to investigate the precise attack vector.
A hot wallet is an internet-connected wallet used to process user withdrawal requests quickly. Binance said it has found no evidence that the private keys to the wallets were directly stolen. The focus of the investigation has shifted to how the attacker penetrated the internal service and transaction approval systems, rather than whether private keys were taken outright. Binance also said the hackers may have used malware to erase traces of the intrusion.
The FBI has attributed the attack to TraderTraitor, a hacking group linked to North Korea. The bureau confirmed that the hackers converted much of the stolen assets into Ethereum, and warned that the funds could be laundered further through decentralized finance platforms and instant exchange services. Law enforcement agencies and industry partners are tracking associated wallet addresses and requesting transaction blocks.
Binance said it will absorb all user losses. The company said it has secured about 95 percent of the affected assets, adding that the remaining 5 percent consists of low-volume, low-liquidity tokens that will take more time to source. The asset coverage drew on the company's Secure Asset Fund for Users, a portion of its futures insurance fund, and corporate treasury funds.
Sourcing replacement assets and actually recovering funds from the hackers are separate matters. Binance and industry partners said they have tracked, frozen or recovered about $3 billion worth of assets, but the movement and ultimate recovery of the remainder have not been confirmed. The exchange is conducting an external security audit and plans to release a report on the incident and preventive measures once the investigation concludes.
attom@heraldcorp.com
