Binance Blames Hacked Engineer Laptop for $6.3 Billion Breach as Attack Echoes Bybit Theft

Binance’s early investigation points to a compromised laptop belonging to a DevOps engineer. The exchange says the attacker may have used it to reach a service container and submit unauthorized withdrawals. It found no evidence that a wallet private key leaked, though the probe is continuing. Security firm Blockaid reached a similar view, calling it key misuse, where a signing system is tricked or compromised into approving bad transactions without anyone stealing the key itself.

The EIP-7702 Delegation Trick Behind the Drain

On chain analysis from Blockaid shows the attacker bundled 50 EIP-7702 authorizations into one transaction aimed at a Binance wallet known as Binance 14. One of them matched the account’s required nonce, so it was accepted. EIP-7702 lets an account hand execution to smart contract code, and in this case the account was delegated to an unverified sweeper contract that let an operator pull out tokens and Ether.

Losses, Freezes and Binance’s Promises

Binance now estimates the total impact at about $6.3 billion and says roughly $3 billion has been frozen on chain with help from partners. It promises to repay all losses from its SAFU fund and company money, to publish a new Proof of Reserves, and to release a full technical post mortem once the facts are verified.

Similarities to the Bybit Hack and North Korea

Blockaid’s Ben Natan called the case very similar to the February 2025 Bybit theft, where attackers took over a Safe developer’s credentials and misled signers into approving a malicious transfer. He said the preparation resembled operations tied to North Korea, but stressed that no attribution is confirmed. Binance has not named the attackers and is working with law enforcement to identify them.