Binance has identified additional points of compromise in a hack that transferred approximately $6 billion from wallets associated with the exchange, deepening an investigation that initially focused on a potentially compromised employee laptop. The exchange has not specified what the newly discovered breach points were, while blockchain investigators have found links between the stolen assets and previous attacks.
According to CryptoSlate, Binance said an earlier preliminary review had pointed to the laptop of a DevOps engineer as a possible route into an internal service container. That access may have enabled an attacker to initiate unauthorized withdrawals. The exchange has since said the incident involved more than that suspected entry point.
Binance has not reported evidence that wallet private keys were leaked. It has also said deposits were not affected and that it would cover all losses. Withdrawals remained paused in the latest update, with the exchange expecting them to resume in 45 hours from that announcement.
How the withdrawal infrastructure was targeted
TRM Labs said the attackers moved about $6 billion across 10 blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Most of the assets were transferred within roughly 20 minutes, although the preparation began much earlier.
The blockchain intelligence firm said the attackers had conducted preliminary transactions and deployed malicious code at least 36 hours before the main withdrawals. On Ethereum, the attacker used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract. A hot wallet is a crypto wallet connected to systems that process transactions, making its signing and withdrawal controls a critical part of an exchange’s infrastructure.
The operation included 50 pre-signed authorizations. TRM said one authorization allowed the attacker to install instructions for executing transactions and then drain assets from the wallet. On other networks, the wallets carried out ordinary-looking transactions with valid signatures.
TRM said the coordinated activity across several blockchains and different signing systems could indicate a compromise of Binance’s hot-wallet signing infrastructure. Binance said it had revoked the affected address authorization and was rebuilding its withdrawal infrastructure.
The exchange also said cooperation with blockchain partners had enabled it to freeze approximately $3 billion in affected assets. Binance pledged to use its Secure Asset Fund for Users, known as SAFU, along with corporate resources to cover losses. It plans to publish an updated proof of reserves after its remediation work is complete.
Investigators point to North Korea-linked group
TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking group linked to North Korea. The firm previously connected the group to the approximately $1.5 billion Bybit exploit in February 2025.
Its assessment was based on both blockchain activity and off-chain intelligence. TRM cited similarities in how the attack was prepared, the use of pre-signed authorizations and the way stolen assets were moved after the withdrawals. Binance has not independently confirmed the identities of the attackers and said it is working with law enforcement and blockchain intelligence companies.
Independent researchers have also reported overlaps with earlier crypto exploits. Blockchain investigator ZachXBT said funds from the Binance incident and September’s approximately $388 million Bitget hack were combined at the same Ethereum address after passing through THORChain. The address identified in that report was 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.
ZachXBT said the convergence suggested the same actor may have been behind both attacks. The Bitget incident had previously been attributed to TraderTraitor, which was also linked to the Kelp DAO incident.
MistTrack identified a separate trail involving TRX stolen in the Binance exploit. It said the tokens moved through Bitget Wallet’s cross-chain bridge before reaching an Ethereum address previously associated with the Phemex hacker: 0xCd684D22E8C3600E6eE93B5a57923c3b517f3396.
These links do not amount to a final public attribution by Binance, but they show how investigators are using transaction histories across multiple networks to follow the movement and possible laundering of stolen crypto assets.
Current market picture
Moneyiar market data at 2026-10-25 22:39 +03:30 showed BNB at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. Aptos was $0.7037841724, down 0.81% in 24 hours and 7.92% over seven days.
Celestia stood at $0.5321576029, unchanged over 24 hours and down 11.85% over seven days, according to Moneyiar data at 2026-10-25 22:38 +03:30. Compound was $21.1287447338, down 10.42% over 24 hours and up 0.3% over seven days, based on Moneyiar data at 2026-10-25 22:39 +03:30.
