Binance points to a possible compromised engineer's laptop as TRM Labs and ZachXBT point toward North Korea, but no official attribution has been made

How the attacker got in is still open. Binance said its initial investigation suggested the incident may involve a compromised DevOps engineer's laptop, which could have let an attacker reach a service container and submit unauthorized withdrawals. It said it had found no evidence that wallet private keys were leaked, and stressed that the findings are preliminary.

Blockchain analysts are pointing elsewhere on who. CoinDesk reports that TRM Labs linked the attack with high confidence to TraderTraitor, a North Korean hacking group, that ZachXBT named the Lazarus Group as the likely attacker, and that Blockaid also pointed to North Korea. Bitcoin.com News stresses that no official attribution has been made. The Bybit theft of February 2025 was attributed to North Korea-affiliated hackers, according to AFP.

On the technical side, Bitcoin.com News reports that the leading explanation involves EIP-7702, an Ethereum feature that lets a wallet authorize a smart contract to act for it. A Blockaid analysis found a delegation transaction with 50 authorizations, one of which matched, and the wallet's assets were swept out about three minutes later. Investigators are weighing a stolen private key, an authorized signer tricked into approving malicious instructions, or a compromised part of Binance's signing infrastructure, and none has been established.