INTEL: TRM Labs links $6.3B Binance hack to North Korea’s TraderTraitor group

Blockchain analytics firm TRM Labs has attributed the roughly $6.3 billion Binance hack to the North Korean group TraderTraitor, saying it has high confidence in the finding. Binance co-founder Yi He said the exchange expects to resume withdrawals within 48 hours.

According to the details supplied, the attackers used Ethereum’s EIP-7702 authorization mechanism. They submitted 50 authorizations against the address labeled Binance 14. Only one succeeded, and it activated malicious code that allowed assets to be drained.

On-chain investigator ZachXBT traced funds from the Binance incident and from the $388 million Bitget exploit to the same address. That points to a possible link between the two attacks, though the supplied material does not show a confirmed connection.

Binance’s preliminary findings

Binance’s preliminary investigation said the incident may have started with the compromise of a DevOps engineer’s laptop. It put the total impact at about $6.3 billion, with about $3 billion frozen on-chain. Binance said losses will be covered by its SAFU fund and company funds. The supplied material does not explain how the laptop finding fits with the EIP-7702 mechanism.

Withdrawals and deposits

In a service update, Yi He said deposits are unaffected and working normally. She said the team is improving withdrawal services and related address controls, and expects withdrawals to restart within the next 48 hours.