The large transfers out of Binance hot wallets on October 29 used an EIP-7702 delegation signed by the hot-wallet key itself, after the operator address had been funded through Tornado Cash. Security researchers have already noted that the broader method resembles earlier exchange attacks in which the signing path was abused rather than a raw private key simply stolen. No firm or agency has attributed the incident.
Signing-path abuse rather than a simple key theft
Blockaid co-founder and CEO Ido Ben-Natan told Cointelegraph that the activity points to compromise or misuse of the signing infrastructure. He described the Binance case as “very, very similar” to the February 2025 Bybit attack, in which attackers manipulated what signers saw and induced them to approve a malicious transaction. In that earlier case the FBI later attributed the theft of roughly $1.5 billion to North Korea’s TraderTraitor cluster. Ben-Natan said the sophistication of the on-chain preparation also resembles operations previously linked to the same actors.
A separate technical reconstruction published by drk.vc lists the same overlaps: access to the signing path rather than a pure key theft, a period of rehearsal, rapid conversion of freezable assets into ETH, and the use of fresh splitter wallets. The piece treats these as pattern matches, not as an attribution.
How the earlier cases were structured
The 2025 Bybit theft was executed through a compromised third-party wallet provider. Attackers altered the interface that Bybit’s signers used, so the people approving the transaction believed they were moving funds under normal conditions. Cold-wallet keys were never extracted; the signing process itself was subverted.
The September 2026 Bitget incident followed a related path. The exchange said attackers compromised a backend system that fed data into the authorisation layer, spoofed the transaction details, and caused Bitget’s own process to sign transfers it had not intended. Cold wallets were untouched. Bitget’s CEO called North Korean involvement “very likely,” and analytics firms noted on-chain and infrastructure overlaps with prior cases attributed to the same groups.
Both incidents, like the Binance outflows, involved multi-chain movement in a compressed window and the use of mixers or fresh addresses for initial funding and later dispersion.
What is different in the Binance case
The attacker used a relatively new Ethereum feature that lets a wallet hand temporary control of itself to a piece of code. The Binance 14 hot wallet signed that handover, pointing it at code the attacker had already prepared. Once the handover was in place, a single transaction moved the wallet’s ether and dozens of tokens. The same access was then used to pull hundreds of millions of dollars in USDC from a second Binance wallet.
That particular method has not been seen at this scale in the earlier North Korea-attributed exchange thefts. The surrounding choices (funding the operator address through Tornado Cash, moving across several chains in a short window, and focusing on the signing process rather than simply stealing a key) are the elements that have drawn the comparisons.
A large share of the transferred value sat in stablecoins. Tether, Circle, Ripple and World Liberty Financial have frozen balances linked to the receiving addresses, and Binance has said $2.54 billion has been frozen so far. In the Bybit case the majority of the haul was native ETH, which issuers couldn’t freeze. The recovery picture was always going to be different and it doesn’t matter who is behind the transfers.
What remains open
Whether further on-chain clustering will link the Binance addresses to wallets previously tied to TraderTraitor or related clusters is still unknown. No public statement from Chainalysis, TRM Labs, Elliptic or ZachXBT has made that connection, and no government agency has attributed the incident.
The open questions are whether the pattern comparison will be strengthened or discarded by later forensic work, and whether the scale of the stablecoin freezes materially changes the outcome relative to earlier exchange thefts that were harder to claw back. For now the documented similarities sit alongside the absence of any confirmed attribution.
Author: Andy Samu
See Also:
Binance Hot Wallets Lose $3.5bn in Potential Record Crypto Hack | Disruption Banking
Is the Lazarus Group Behind the $1.5 Billion Bybit Crypto Heist? | Disruption Banking
Andrew Samu
Andrew Samu, Editor-at-Large at Disruption Banking, shapes the publication’s global coverage of banking, capital markets and digital assets. Based at London’s Level39, he combines market analysis with a strong commercial perspective, informed in part by his role as Commercial Director at Verita HR.
