Binance hack exposes security gaps across five blockchain networks - grafa.com

Investigators have linked the sophisticated attack to North Korea's TraderTraitor group, which targeted billions of dollars in assets across Bitcoin, Ethereum, XRP, TRON, and Solana.

While investigators emphasize that no protocol-level breaches occurred within the networks themselves, the exploitation of specific features, such as Ethereum's EIP-7702 delegation, allowed the attackers to siphon massive sums.

The aftermath of the breach has starkly highlighted the structural divide in crypto regulation and control; while central authorities successfully froze roughly $2.7 billion in issuer-controlled tokens, truly decentralized assets remained entirely immune to external intervention.

Bitcoin and Ethereum outflows

Bitcoin recorded approximately 18,270 BTC in outflows from Binance wallets, valued at roughly US$1.47 billion when transferred.

The attacker divided the Bitcoin into 19 wallets, including 17 holding exactly 1,000 BTC each.

Ethereum recorded approximately US$3.79 billion in Binance-related outflows, including 200,630 ETH and numerous other tokens.

The attacker exploited Ethereum's EIP-7702 delegation feature, using 50 pre-signed authorisations to execute unauthorised wallet transactions.

Bitcoin's lack of a central token issuer also means no authority can directly freeze BTC through an issuer-controlled blacklist.

XRP, TRON, and Solana affected

The XRP Ledger recorded outflows of approximately 233.46 million XRP, valued at US$296 million when transferred from Binance wallets.

The transactions occurred between 20:05 and 20:09 UTC on October 29, with five Binance wallets sending funds to an attacker-controlled address.

TRON recorded approximately US$628 million in Binance-related outflows, including 612.7 million USDT and 46.4 million TRX.

The transfers occurred within the same attack window as the Ethereum, Bitcoin and XRP Ledger movements.

Solana recorded approximately 970,500 SOL in Binance-related outflows, valued at around US$96 million when transferred.

The transfers formed part of the initial wave of unauthorised movements across Binance's connected blockchain wallets.

Recovery challenges and next steps

The Binance security incident exposed different recovery challenges across five major blockchain ecosystems, with approximately US$2.7 billion frozen through issuer and network interventions.

Bitcoin presents a different recovery challenge because no central issuer can freeze its native tokens, while stablecoin issuers can restrict transfers through their token contracts.

The incident also reinforces the importance of exchange wallet authorisation, cross-chain security controls and independent blockchain monitoring.