Binance’s $6.36B Heist Exposes Authorization Flaws, Not Cryptography

The largest cryptocurrency heist in history targeted Binance on October 29, with attackers stealing approximately $6.36 billion in digital assets within 20 minutes without breaking the platform's cryptography. Investigators, including TRM Labs, attribute the attack to North Korean-linked group TraderTraitor, which exploited Binance's signature infrastructure to authorize valid transfers. The attackers reportedly compromised a DevOps engineer's laptop and used EIP-7702 functionality to delegate wallet controls. The incident highlights that blockchain security differs from system security, as attackers manipulated legitimate authorization mechanisms rather than cryptographic weaknesses. Experts recommend strengthening access controls, limiting permissions, and implementing rapid response systems for suspicious transfers.