The recovery effort after the $6.3 billion Binance exploit is picking up pace. Ripple has frozen about $200 million connected to the attack, according to Binance co-founder Yi He. Binance says about $3 billion of the stolen funds has now been frozen in total.
A new on-chain finding has also raised the stakes. Blockchain investigator ZachXBT says the attacker appears to be the same one behind the recent $388 million Bitget hack, which has been attributed to hackers linked to North Korea.
Who Has Frozen What
Stablecoin issuers and blockchain networks moved quickly to lock up stolen funds:
- Ripple: about $200 million, frozen “promptly,” according to Yi He
- World Liberty Financial: $27 million in USD1 and 48 million WLFI tokens, worth about $2 million
- Arbitrum Security Council: about $30.5 million, frozen through an on-chain transaction
- Total frozen: about $3 billion, according to Binance
Binance said it is working with law enforcement, token issuers, blockchain analytics firms and industry partners to trace and freeze more assets. It added that it will only share confirmed figures.
ZachXBT Points To North Korea-Linked Group
ZachXBT said funds from the Binance exploit and the Bitget exploit were combined at the same wallet address after passing through THORChain, a cross-chain swap protocol. In his view, that suggests a single actor is behind both attacks.
The Bitget hack has been attributed to TraderTraitor, a hacking group linked to North Korea. ZachXBT said the group has also been tied to earlier attacks, including the Kelp DAO exploit.
How The Attack Worked
Early on-chain analysis suggests the hacker used EIP-7702, a feature added in Ethereum’s Pectra upgrade. It allows an ordinary wallet to act like a smart contract for a short time, as long as the request is signed with a valid private key.
The attacker’s method, as described by on-chain researchers:
- Collected 50 signed EIP-7702 authorizations in advance, each with a different sequential nonce
- Did not know which nonce would be valid at the moment of the attack
- Submitted all 50 at once, so that one of them would match
Only one needed to work, and one did.
Binance said the breach had “multiple factors.” Its security team is tracing the full attack path through a compromised computer that may have been the entry point. The exchange promised a full report on the root cause.
What It Means For Binance Users
- Losses: Binance says it will cover all hacking losses and that user funds are safe.
- Deposits: working normally.
- Withdrawals: still paused while Binance rebuilds its withdrawal system and related addresses, with a restart expected within 48 hours.
- Updates: users are urged to follow only official Binance channels.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
