Elliptic links North Korea actors to $6.3B Binance theft

Blockchain analytics firm Elliptic says North Korea-linked actors stole $6.43 billion from Binance hot wallets on Oct. 29, including by using Ethereum’s EIP-7702 delegation feature to give a sweeper contract continuing control over one wallet. The attribution is an intelligence assessment, not an official finding: Elliptic says no government or law enforcement agency has confirmed who carried out the theft.

Elliptic’s analysis tracks withdrawals across 11 blockchains and estimates Binance’s impact at about $6.3 billion. Separately, the Associated Press reported that TRM Labs attributed the attack to North Korea-linked group TraderTraitor, while Chainalysis also assessed that TraderTraitor was likely responsible. Binance told AP that it was working with law enforcement to confirm the criminals’ identity. Elliptic’s incident analysis says some stolen funds later reached an address that also received proceeds from a suspected North Korea-linked Bitget exploit; Elliptic cautions that the overlap is small and does not prove the same actors carried out both attacks.

How did the attacker use EIP-7702?

On Ethereum, EIP-7702 lets a regular externally owned account delegate its behavior to a smart contract. Elliptic says the attacker used the feature against Binance’s hot wallet Binance 14, rather than stealing its private key.

According to Elliptic, the attacker deployed a sweeper contract and submitted one transaction containing 50 authorizations, each signed with Binance 14’s key and covering a different nonce. The different nonces meant one authorization would match the wallet’s transaction count when the transaction landed. The valid authorization delegated Binance 14’s behavior to the sweeper contract, which then emptied the wallet three and a half minutes later, taking 167,464 ETH and 63 tokens, including 1.6 billion USDT.

The delegation remained active, Elliptic says. The attacker used Binance 14’s owner rights over another Binance wallet to withdraw 823 million USDC and swept later deposits into Binance 14 four more times. Elliptic also reports that the attacker made ordinary signed withdrawals from Binance wallets on the other affected chains. Its analysis says this pattern suggests access to Binance’s signing infrastructure; Binance has said it found no evidence of a wallet private-key leak.

What evidence supports the North Korea attribution?

Elliptic cites the address overlap with proceeds from the Bitget exploit, attack preparation, and similarities to earlier thefts attributed to North Korea, including the 2025 Bybit hack. Those indicators support the firm’s assessment, but do not establish the attacker’s identity. Elliptic notes that laundering networks may serve multiple clients and says North Korea-linked groups typically move stolen funds faster than the Binance attacker did.

TRM Labs separately described TraderTraitor as North Korea’s elite hacking unit and said its assessment was made with high confidence, according to the Associated Press report on the firms’ attribution. AP reported that TRM estimated about $6.36 billion moved out of Binance wallets on ten blockchains, mostly within about 20 minutes. Elliptic’s own analysis counts 11 chains and gives a different total; the firms’ figures are separate estimates.

What happened to the stolen assets?

Elliptic verified $2.84 billion in frozen funds in its Oct. 30 analysis, close to Binance’s estimate of roughly $3 billion frozen with blockchain partners reported by AP. Stablecoin issuers including Tether and Circle froze assets, while Elliptic reports that Arbitrum’s Security Council moved assets out of the attacker’s reach. These controls can affect issuer-managed tokens; they cannot freeze native assets such as ETH or bitcoin.

Elliptic says the attacker converted some stablecoins into ETH and TRX, which have no issuer able to freeze them, and began moving funds between chains. Binance said withdrawals were suspended during security checks and that it would cover users’ losses. The exchange had not disclosed the additional breach points identified by its investigation in the AP report.

References

• Elliptic’s incident analysis — elliptic.co
• Associated Press report on the firms’ attribution — apnews.com