How North Korea Stole $6.3 Billion From Binance in 20 Minutes

Jonty said he woke to roughly 1,000 messages reporting that Binance’s hot wallets across Ethereum, Bitcoin, Tron, Solana, and other chains had been drained. The initial total was estimated at about $6.4 billion, making it the largest hack discussed, though roughly half was later frozen. Pablo explained that the attackers apparently did not obtain Binance’s private keys directly. Instead, they compromised infrastructure that could instruct the exchange’s signing system to approve withdrawals, likening it to gaining access to a bank employee’s pen rather than stealing the bank’s checks.

Pablo said the attackers pre-signed 50 transactions with different nonces, then inserted a malicious transaction among legitimate withdrawals. That transaction used EIP-7702 to temporarily turn a normal externally owned Ethereum account into a smart-account-controlled wallet; the attackers then swept its assets to another address. Because deposits continued arriving, the malicious logic automatically removed new funds as well. Pablo and Jonty stressed that EIP-7702 was not the original vulnerability: compromised signing access enabled the theft, while the upgrade made draining assets faster and more efficient and increased the attack surface.

Binance initially said a compromised DevOps engineer’s laptop gave an attacker access to a service container, but later acknowledged additional breach points. Jonty said a single infected laptop leading directly to a $6.4 billion drain would raise serious questions, although the full facts were unknown. Pablo argued that the laptop was probably only initial access: attackers may have escalated privileges, moved laterally through internal systems, and reached transaction-signing infrastructure. He warned that the theft may have been prepared weeks or months before the public cash-out, rather than beginning on the day Binance noticed it.

The stolen assets included XRP, ETH, Arbitrum, Avalanche, Optimism, Base, Tron, Solana, Polygon, and multiple stablecoins. Jonty said the cross-chain scope indicates that Binance’s internal wallet-signing infrastructure was compromised, not that the attackers independently broke each blockchain or extracted every private key. Pablo suggested Binance likely used hardware security modules to protect keys, but argued that such hardware is ineffective if it blindly trusts a compromised server telling it which transactions to sign. Jonty did not consider Binance’s distributed hot-wallet balances an obvious error, since a large exchange may need to service rapid withdrawals and possible bank runs.

Researchers observed transactions on October 8 that appeared to test the EIP-7702 draining mechanism, roughly three weeks before the Binance theft. Jonty said those tests showed how the technique worked against an Ethereum wallet but did not reveal that Binance would be targeted, so they would have been difficult to use as a direct advance warning. Pablo said the activity was still valuable for incident response because it expands the period investigators should examine in logs, developer communications, and access records. Jonty supported sharing such intelligence through trusted networks but said operational security would have offered more protection.

Circle, Tether, and Arbitrum’s Security Council moved quickly to freeze stolen assets, leaving about $3 billion unavailable to the attackers, or roughly 43% of the total. Jonty contrasted this with the Bybit incident, where less than 3% was frozen, and said the response was unprecedented. He also argued that Circle’s speed reflected its commercial relationship with Binance: the theft threatened its own bottom line, unlike the Drift hack. Jonty expected the freezes to change North Korea’s immediate laundering tactics, but not its broader behavior of stealing whatever assets it can reach.

The attackers reportedly sold about $60 million in USDT to market makers and borrowed nearly 20,000 ETH against it on Aave, converting potentially frozen assets into funds that could not be frozen in the same way. Aave froze markets across its networks because freezing only the stolen-token reserves could have left alternative routes open, though users could still repay, withdraw, or face liquidations. Jonty said the scale of the movement strained DeFi liquidity and produced extreme slippage, including a reported $5 million swap for $72. Pablo said DeFi’s permissionless and censorship-resistant design will inevitably attract this use, but argued that protocols need circuit breakers for unusually large transfers.

Jonty said most of the laundering volume on major North Korean hack days moved through THORChain, with more than 99% of that day’s volume reportedly connected to stolen-fund laundering. Binance liquidity providers helped arbitrage and rebalance THORChain pools, although Jonty corrected an Arkham claim that Binance itself was directly laundering the funds. THORChain later halted several chains after a reorganization caused a vault to pay out 10 ETH it had not received; only three node votes were needed. Jonty called the protocol’s herd-like governance and continued halt troubling, while Pablo noted that new node operators cannot join without approval, weakening claims of permissionlessness.

The FBI, Secret Service, and IRS Criminal Investigation named THOR node operators and related service providers in a request to block transactions linked to North Korean laundering. Jonty called the warning a serious national-security signal because stolen crypto can fund North Korea’s weapons program. He identified TraderTraitor as one of several Reconnaissance General Bureau subgroups, not a synonym for all North Korean activity. TraderTraitor typically conducts fake, multi-round job interviews that persuade developers to run malicious coding-test software, historically disguised as crypto trading applications. The resulting wallet-spreading activity is often automated to evade transaction-monitoring systems.

Pablo said most crypto security specialists focus on smart contracts rather than operational security, leaving organizations unprepared for infected laptops, social engineering, and privilege escalation. His immediate recommendation was endpoint detection and response software, such as CrowdStrike, rather than relying on antivirus or employees’ confidence that they will not be infected. Jonty added that executives and security teams need to understand the specific adversaries targeting crypto so they can allocate resources intelligently. He also urged the industry to debate whether unlimited permissionlessness is sustainable when protocols knowingly enable laundering, rather than waiting for regulators to force a response.