Evgeniy Yanov, Head of Audit and Consulting Department at F6:

(MENAFN- MENAFNEditorial) "The attack vector employed by the hackers in the Binance incident is nothing new. It follows one of the most well-established scenarios: the attack does not begin on the blockchain itself, but rather at the workstation of an employee with access to critical infrastructure.

For example, in a 2022 incident involving Sky Mavis, an employee was lured by a fake job offer containing a malicious documen— — the attackers gained control over the majority of the Ronin net’ork’s validator keys and stole approximately $600 million. In 2024, an employee at a DMM Bitcoin contractor fell for a fake recruiter on social media, resulting in a $300 million loss. And in 2025, the compromise of a dev’loper’s machine at a third-party wallet service provider enabled interface spoofing, effectively tricking Bybit into transferring $1.5 billion to the attackers.

In broad terms, the mechanics of the recent Binance breach mirror the Bybit incident. In both cases, the target was not the blockchain itself, but rather an individual or a process involved in the transaction-signing workflow. However, there is a fundamental difference. In the Bybit case, the wallet d’veloper’s system was compromised, and the authorized signers were—deceived — they saw a fraudulent interface and personally approved a malicious transaction. In the Binance incident, according to the company, the attack was carried out via a service—container — an automated fund-withdrawal system. The platform Blockaid highlights an even more unique element: a batch of 50 EIP-7702 authorizations within a single transaction, combined with the delegation of an account to a malicious "sweeper" contract. This specific mechanism has not been seen before in large-scale breaches of this size.

This explains why multi-signature schemes and "cold" wallets failed to protect the assets. Multi-signature schemes protect against the theft of an individual key, but they are ineffective if the signing management process itself is compromised. If an attacker has already infiltrated the environment where transactions are approved, the required quorum can be reached in a way that appears entirely legitimate. In the case of "cold" wallets, exchanges need to process frequent withdrawals; consequently, an automated process must exist to bridge the gap between offline keys and t—e blockchain — and it is precisely this process that becomes the primary target.

According to some unconfirmed sources, the compromise has been linked to a DevOps engineer who used an AI agent in an insecure manner. A Codex file containing a private SSH key f’om the engineer’s machine was discovered on a thi—d-party platform — the AI agent had likely been assisting the employee with deployment and configuration tasks. Attackers leveraged this key, identified that they had gained access to a Binance DevOps machine, and from there, managed to reach the withdrawal authorization process.

This incident highlights a concerning trend: leaks of keys and tokens frequently lead to majo— security breaches — a problem that has only intensified with the proliferation of AI. Malicious software has long targeted SSH keys, cloud credentials, and environment (.env) files on developers' machines. AI agents with access to the file system further expand the attack surface, inadvertently aiding attackers in their eff rts."


F6 Threat Intelligence Department:

"Researchers attribute the attack to TraderTraitor — an elite North Korean hacking unit considered part of the broader Lazarus infrastructur— — based on a combination of on-chain and off-chain intelligence.

The group's signature matches previous thefts: small Tornado Cash withdrawals used to fund the operator's wallet, extensive preparation well before the actual heist, and pre-signed transactions executed in a single burst. The FBI identified the same patterns when it named the group responsible for the Bybit hack in February 2025, as well as the KelpDAO breach in April 2026.

The only notable difference lies in the laundering method. Instead of the cross-chain bridge scheme seen after Bybit, the attackers relied on large swaps through market makers and lending protocols. Notably, Binance has not yet officially named those responsible, and the full attribution materials have not been publis—ed — leaving room for independent verification."

MENAFN01112026000070015918ID1111898155