The Historic Binance Hack Unfolds

Investigators have officially tied a massive $6.3 billion security breach to North Korea, marking what is now recognized as the largest exchange hack in history. According to reports from The Block, the incident involved a severe compromise of hot-wallet signing infrastructure.

Despite the staggering scale of the theft, the market's initial reaction has been relatively muted. Cryptonews notes that this measured response is partly due to the exchange's proactive measures following the security breach.

On-Chain Mechanics of the Ethereum Breach

According to analysis published by Protos, the exploit relied in part on manipulating wallet delegation functions on the Ethereum network. The attacker deployed a sweeper contract and transmitted 50 EIP-7702 authorizations targeting an address identified as Binance 14, signed using the Binance 14 key.

Because the hot wallet was in rapid use, the attacker had to submit a wide variety of approvals with varying nonce values to ensure the transaction counts matched. Once approved, the sweeper contract operated as the Binance 14 account, successfully sweeping away ether and tokens.

Other wallets, such as Binance 16, transferred funds through normal transactions rather than delegation. Similarly, other EVM-compatible chains like Base, Optimism, Arbitrum, Avalanche, and Polygon relied on mundane transfers rather than delegation exploits.

Recovery Efforts and Asset Freezes

In response to the breach, Binance has allocated $6.34 billion to cover potential hack losses, according to statements reported by The Block. Furthermore, industry partners have stepped in to freeze an additional $3 billion in affected assets.

Binance eventually succeeded in removing the delegation vulnerability from the Binance 14 address. Additionally, approximately $2.4 billion worth of funds that had been removed from Binance wallets on Ethereum have been successfully frozen or blacklisted.