Binance Hack Involved EIP-7702 Wallet Approval as Investigation Uncovers More Breach Points
Summary
Binance says its hack may have started with a DevOps laptop, while Teng says the attacker used EIP-7702 to approve a hot wallet outside normal controls. Binance later found additional breach points; attribution to TraderTraitor is unconfirmed.
Key points
- Binance says the incident may have begun with a compromised DevOps engineer’s laptop, which allowed access to a service container and unauthorized withdrawal transactions.
- Binance puts the impact at about $6.3 billion, says about $3 billion has been frozen on-chain, and says it will cover losses.
- Teng says the attacker used EIP-7702 to obtain approval to act on a hot wallet without Binance’s normal approval controls; Binance has found no evidence of a wallet private-key leak.
- Binance later reported additional breach points beyond the laptop but has not detailed them. It has not said how the laptop was compromised.
- TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean hacking unit; Binance has not confirmed that attribution.
- The article describes credential and session-token theft as a plausible route from a compromised developer device to systems trusted to submit withdrawals, not as a confirmed account of the Binance attack.
- It recommends short-lived credentials, independent approval for high-value actions, alerts for unusual credential use, and managing devices that access production.
Article Details
- Victim Organization
- Binance
- Incident Type
- Reported compromise involving a DevOps engineer's laptop, access to a service container, and unauthorized withdrawal transactions. Richard Teng said the attacker used EIP-7702 to obtain approval over a hot wallet outside Binance's normal approval controls. Binance later reported additional breach points beyond the laptop.
- Operational Impact
- Binance put the incident's total impact at about $6.3 billion. About $3 billion had been frozen on-chain at the time described. Binance said it would cover all losses. The article reports no evidence that a wallet private key was leaked.
- Claim Status
- confirmed
People
Threat Actors
Jade SleetTRM Labs and Chainalysis attributed the Binance incident to this North Korean hacking unit; Binance had not confirmed the attribution.Lazarus GroupThe article attributes the malicious npm package react-html2pdf.js to Lazarus Group based on fingerprints in the code and infrastructure. The package's payload could not run as published.
Vendors
AikidoBinance’s normal approval controls. We see attacks on developer devices every day - just last week Aikido blocked nearly 500 malware attacks. Here is how one compromised laptop can lead to a service that movesChainalysisTRM Labs and Chainalysis have attributed the incident to TraderTraitor, a North Korean hacking unit. Binance has not confirmed that attribution.TRM LabsTRM Labs and Chainalysis have attributed the incident to TraderTraitor, a North Korean hacking unit. Binance has not confirmed that attribution.