The Binance Hack Began With One Laptop

An estimated $6.3 billion vanished from Binance within about 20 minutes, marking the largest crypto heist in history. This staggering sum, roughly four times larger than the previous record, moved across multiple blockchains in a flurry of unauthorized transactions. The sheer scale suggests an attacker with deep access, not merely an opportunistic hack.

Investigators suspect the breach began with a single compromised engineer’s laptop, a seemingly innocuous starting point for such a massive theft. This initial foothold provided an entry point into Binance’s internal infrastructure, allowing the attacker to manipulate its signing systems without directly exposing any private keys. This distinction is crucial: the keys remained secure on their respective machines, but the system authorized to use them was compromised.

Binance described a DevOps-machine breach alongside "additional points of breach," indicating a complex, multi-stage attack. Forensic accounts are still pending, but reported findings suggest the attacker coerced Binance’s own systems into signing arbitrary transactions. This enabled the rapid draining of hot wallets, demonstrating a sophisticated exploitation of internal operational controls.

Binance uses shared hot wallets for customer withdrawals, a standard exchange practice. Each transfer requires a private key signature, yet Binance found no evidence of key exfiltration. This distinction is critical: the attacker didn’t steal the keys; they coerced Binance’s own systems to sign illicit transactions.

A security firm reportedly traced 11 distinct keys signing transfers to the attacker, indicating a systemic compromise, not a single key leak. This suggests a far more insidious attack vector than simple credential theft. The attacker allegedly bypassed typical safeguards by manipulating Binance's internal infrastructure.

Attackers likely compromised internal services or containers, effectively turning Binance's trusted signing system into an unwitting accomplice. They could then request valid signatures from Binance’s own systems, enabling them to authorize arbitrary transactions. This allowed them to "sweep" hot wallets, draining funds without ever possessing the private keys directly.

On Ethereum, the attacker prepared 50 pre-signed authorization notes to exploit transaction nonces. Because the hot wallet was actively processing customer withdrawals, 49 attempts failed due to a counter mismatch. However, one attempt matched the exact sequence, sweeping the wallet down to a mere 1 ETH. This sophisticated abuse of the signing process highlights a profound breach of trust in the system itself.

Attackers faced a moving target. Ethereum transactions each carry a nonce, a sequential value acting as a transaction counter. Because the hot wallet was still processing customer withdrawals, its nonce constantly changed, rendering any pre-signed authorization invalid if its expected nonce value was stale.

Their reported tactic was a brute-force elegance: prepare 50 pre-signed authorizations. Of these, 49 attempts reportedly missed the correct nonce as the counter advanced. However, one matched precisely, enabling a sweep that drained the wallet, leaving a mere 1 ETH behind.

This sophisticated attack reportedly leveraged EIP-7702, a proposal allowing externally owned accounts to temporarily delegate smart-contract-like behavior. This delegation could enable complex actions, like a programmatic sweep, directly from the hot wallet address, bypassing standard multi-signature controls. Such capabilities underscore why robust transaction validation and stringent internal controls are paramount. For further details on the breach, see Binance Links $6.3 Billion Crypto Theft to Compromised DevOps Laptop.

Then came the freeze: an estimated $2.7–3 billion in centralized tokens reportedly became unreachable. Issuers like Tether and Circle quickly blacklisted stolen assets, freezing over $1.5 billion in USDT and $800 million in USDC, respectively. Ripple and Arbitrum’s Security Council also froze remaining stablecoin balances, demonstrating the inherent centralization and intervention capabilities of these assets.

But the remaining $2.4 billion proved far more elusive. Assets like ETH and BTC, converted and bridged onto decentralized base layers, fell beyond the reach of any single entity’s freeze command. This stark split highlights the enduring trade-off in cryptocurrency: centralized tokens offer recovery options, while decentralized assets uphold censorship resistance.

Tracing firms quickly attributed the sophisticated attack to North Korean-linked actors. Binance, for its part, committed to covering all losses from its own funds, paused affected services, and promised a comprehensive technical post-mortem. The incident underscores a critical paradox: even as some crypto assets promise immutable decentralization, the infrastructure that secures them remains a tempting target for highly organized state-sponsored threats.

How did the Binance hack reportedly work?

Investigators say attackers may have compromised internal systems and used Binance’s authorized signing infrastructure to approve malicious transfers, rather than stealing wallet private keys directly.

Why did the attacker prepare 50 signed authorizations?

The wallet’s transaction counter, or nonce, kept changing as it processed withdrawals. The attacker reportedly prepared multiple attempts so one could match the counter’s exact value.

Why could some stolen crypto be frozen but not all of it?

Centralized token issuers can blacklist some assets, such as stablecoins. Native assets like ETH and BTC do not have a single issuer with the same ability to freeze them.

Did Binance say user funds would be reimbursed?

Binance said it would cover losses with its own funds, including its SAFU fund, while it investigated and worked to restore affected services.