Statements

The effects of the hack on crypto markets were compounded by tech-stock losses that came with Q4 earnings projections.

Binance is buying altcoins in quantities matching those stolen in the hack as it prepares updated proof of reserves,

Ben-Natan warned that similar signing-system attacks threaten other exchanges and said transaction simulation could help detect malicious requests before they receive approval.

“This is a problem with EIP 7702, it’s just very, very poorly understood,” Georgiev said.

He said attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.

“The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

Binance has set aside more than $6.34 billion in company funds to cover losses from the hack, the exchange said. The company said $5 billion of those funds were already held in the same tokens affected by the attack.

The attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens, Bitquery added.

According to Bitquery, 17 of the attackers’ Bitcoin addresses held 1,000 BTC each, while the remaining coins sat in two other wallets.

Blockchain analytics firm Bitquery traced 18,270 Bitcoin (BTC), worth roughly $1.4 billion, to 19 addresses linked to the attacker.

“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.

Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.

Approximately $2.8 billion has been frozen so far.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.

In a series of posts, Yi He, Binance's co-chief executive, thanked various cryptocurrency issuers for freezing the assets. "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said.

Check Point's Dave said this attack also resembled a hack on crypto exchange platform Bitget in September in which $388m (£289m) was lost: "This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them."

Chainalysis, a crypto analytics firm, also said it has "high confidence" that the North Korean group are linked to the hack.