Binance Exploit Recovery Gains Momentum as Ripple Freezes $200 Million
The recovery effort following the $6.3 billion exploit on the cryptocurrency exchange Binance is accelerating, with significant progress reported in freezing stolen assets. Binance co-founder Yi He announced that Ripple has frozen approximately $200 million linked to the attack. This brings the total amount of frozen stolen funds to an estimated $3 billion, according to Binance.
Adding a new layer of concern, blockchain investigator ZachXBT has revealed that the attacker behind the Binance exploit appears to be the same entity responsible for the recent $388 million hack of Bitget. This latter incident has been attributed to hackers with suspected ties to North Korea.
Frozen Assets: A Collaborative Effort
Stablecoin issuers and various blockchain networks have acted swiftly to lock down the illicitly obtained funds. Binance stated it is actively collaborating with law enforcement agencies, token issuers, blockchain analytics firms, and industry partners to trace and freeze additional assets. The exchange emphasized that it will only release confirmed figures regarding the recovered funds.
ZachXBT Links Attacks to North Korea-Affiliated Group
ZachXBT’s analysis indicates that funds from both the Binance and Bitget exploits were consolidated into a single wallet address after transiting through THORChain, a cross-chain swap protocol. This observation leads ZachXBT to believe that a single actor is behind both sophisticated attacks.
The Bitget hack has been officially attributed to TraderTraitor, a hacking collective with known links to North Korea. ZachXBT further noted that TraderTraitor has been implicated in previous security incidents, including the Kelp DAO exploit.
Unraveling the Attack Mechanism
Initial on-chain analysis suggests that the perpetrator may have leveraged EIP-7702, a feature introduced in Ethereum’s Pectra upgrade. This functionality allows a standard wallet to temporarily function as a smart contract, provided the request is authenticated with a valid private key.
According to on-chain researchers, the attacker’s method involved a process where only one specific action was required to succeed, and that action was indeed successful.
Binance has indicated that the security breach was the result of “multiple factors.” The exchange’s security team is currently investigating the complete attack vector, which may have originated from a compromised DevOps engineer’s laptop, potentially serving as the initial entry point for unauthorized withdrawal transactions. Binance has pledged to release a comprehensive report detailing the root cause of the incident.
Leave a Reply