Binance points to engineer’s hacked laptop in $6.3B breach
Update (Oct. 30 at 2:44 am UTC): This article has been updated to include Binance’s preliminary investigation into the security breach.Binance said its initial investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop.The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak, though its investigation remains ongoing.Speaking to Cointelegraph earlier on Thursday, Ben-Natan said Blockaid’s preliminary assessment also pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key“It seems to be … a compromise of signing infrastructure. We don’t think a key was leaked,” he said.Ben-Natan’s assessment drew on Blockaid’s experience with similar attacks and its observations of the onchain activity.Binance estimates $6.3 billion impact, freezes about $3 billionBinance has now put the estimated total impact at around $6.3 billion and said it had worked with blockchain partners to freeze approximately $3 billion in affected assets onchain.The exchange said it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, adding that user funds were safe. It also pledged to publish an updated Proof of Reserves.Binance temporarily suspended deposits and withdrawals while conducting security checks and said it had revoked the affected address authorization. It is working with law enforcement and blockchain intelligence partners to trace and recover funds.The exchange said it would publish a detailed technical post-mortem once the investigation was complete and the facts fully verified.Blockaid identifies malicious wallet delegationIn its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted.EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network.Before Binance’s latest update, Arkham CEO Miguel Morel told Cointelegraph there was insufficient information to determine whether the attack involved stolen keys or compromised infrastructure.“From what we can tell, it appears the hack is still ongoing,” he said at the time.North Korea, Bybit comparisonAsked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”In that case, Bybit’s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.Ben-Natan also said the activity resembled operations linked to North Korea, citing Blockaid’s familiarity with those attacks. He pointed to sophisticated onchain preparations but emphasized that the attribution remained unconfirmed.Binance has not identified the attackers, saying it is working with law enforcement to establish their identities.