Binance reports that a compromised DevOps laptop may have been used by attackers to gain entry to internal infrastructure.
Binance noted that its preliminary probe into the multi-billion-dollar crypto hack pointed to a compromised DevOps engineer’s laptop having been accessed by intruders.
The exchange noted that breaching the laptop likely allowed an intruder to penetrate a service container, where unauthorized withdrawal transactions were submitted. Investigators confirmed no evidence indicates private wallet keys were leaked, though the inquiry remains ongoing.
Speaking to earlier Thursday, Ben-Natan explained that Blockaid’s early findings also suggested “key misuse,” where a signing system gets tricked or compromised into authorizing fraudulent transactions without the underlying private key being extracted.
“It seems to be … a compromise of signing infrastructure. We don’t think a key was leaked,”
he said.
Ben-Natan’s evaluation relied on Blockaid’s prior experience with comparable exploits, alongside data gathered from onchain activity observations.
Binance Reports $6.3B Impact and Freezes Nearly $3B in Assets
Binance now estimates the overall financial damage at roughly $6.3 billion, noting that roughly $3 billion in affected assets was frozen onchain after teams coordinated with blockchain partners.
The exchange confirmed it would absorb all losses using its Secure Asset Fund for Users (SAFU) alongside corporate reserves, assuring clients that user assets remained safe while promising that an updated Proof of Reserves would be published.
Binance temporarily paused deposits and withdrawals while running security checks, noting that the compromised address authorization was revoked. The platform is currently collaborating with law enforcement and blockchain intelligence firms to track down and recover the stolen funds.
The exchange indicated that a comprehensive technical post-mortem would be published once investigators wrap up the inquiry and fully verify all facts.
Blockaid Detects Malicious Wallet Delegation Activity
In an onchain breakdown posted to X, Blockaid explained that the hacker packed 50 EIP-7702 authorizations into one transaction directed at Binance 14. Analysts noted that a single authorization matched the account’s necessary nonce, enabling the request to be accepted.
EIP-7702 enables standard accounts to delegate execution rights to smart-contract code. Blockaid noted that control of the compromised account was delegated to an unverified sweeper contract, empowering a designated operator to siphon off both tokens and Ether.
Ben-Natan informed that the exploit likely spanned several compromised devices, with movement through the exchange’s internal network being detected during the attack.
Prior to Binance’s recent statement, Arkham CEO Miguel Morel shared with that limited data made it difficult to establish whether compromised infrastructure or stolen keys were used to execute the attack.
“From what we can tell, it appears the hack is still ongoing,” he said at the time.
North Korea’s Crypto Operations Compared With the Bybit Hack
When asked whether the suspected signing manipulation mirrored the February 2025 Bybit exploit, Ben-Natan described the two breaches as being “very, very similar.”
In that instance, Bybit’s released forensic report indicated that intruders hijacked a Safe developer’s credentials, penetrated the wallet provider’s backend, and tricked signers into approving a fraudulent transaction that was successfully processed.
Ben-Natan also mentioned that the incident aligned with tactics tied to North Korea, drawing on Blockaid’s extensive tracking of such exploits. He highlighted intricate onchain preparations, while stressing that the attribution had not yet been confirmed by investigators.
Binance has yet to identify the culprits, stating that active coordination with law enforcement is being conducted to uncover their identities.
