Binance's $6.36B crypto heist exposes transfer authorization flaws

The largest cryptocurrency theft in history, targeting Binance on October 29, succeeded in 20 minutes without breaking cryptography, shifting security concerns to transfer authorization systems. Attackers, likely linked to North Korea, stole approximately $6.36 billion in digital assets. Investigators from TRM Labs attribute the attack to the TraderTraitor group, which exploited Binance's signature infrastructure for hot wallets rather than stealing private keys. The attackers used EIP-7702, a May 2025 Ethereum feature, to delegate wallet functions to a smart contract, moving 167,464 ethers and other tokens in one operation. The breach affected wallets across ten blockchains, suggesting a shared authorization system was compromised. This incident highlights the distinction between blockchain security and the systems interacting with it, emphasizing the need for stronger access controls and monitoring of anomalous transfers.