An attack involving billions of dollars in assets may not have started with the exchange's servers or on-chain contracts, but rather with a laptop regularly used by an employee.

Hackers allegedly first compromised the office equipment of a Binance employee, then gradually gained internal access or trading signature conditions, ultimately extending the attack to the exchange's hot wallets. This suggests that the attackers may not have directly breached the exchange's most critical security defenses, but rather opened a gap from what seemed to be an ordinary office terminal.

From employee computers to hot wallets, and then to the abnormal transfer of billions of dollars in assets, this incident has also exposed an often-overlooked issue: the security risks of exchanges may sometimes originate from the most routine office devices.

Large asset transfers occurred within 40 minutes

In the early morning of October 30th, multiple hot wallets of Binance experienced abnormal asset transfers.

On-chain tracking information shows that around 4:20 AM, the attackers began related operations. Approximately 4 minutes later, large amounts of assets started flowing out of Binance’s hot wallets. One transaction transferred assets worth approximately $900 million.

The entire process lasted about 40 minutes and involved more than 60 types of tokens, including ETH, USDT, and USDC. External institutions have provided different estimates of the scale of related abnormal transfers, with some statistics reaching billions of dollars.

It is important to note that the on-chain amounts of abnormal outflows, the assets actually controlled by the attackers, and the final confirmed losses are not the same concept; currently, it is still not possible to directly view all transferred amounts as the final stolen amount.

EIP-7702 became a key link in the attack chain

In addition to the employee computer as a suspected entry point, EIP-7702 also became a focus of the investigation into this incident.

EIP-7702 is an account feature launched by Ethereum that allows ordinary accounts to execute smart contract code after authorization. It itself is not a security vulnerability, but if attackers obtain valid authorization, they could use the related mechanism to execute asset operations that should not occur.

Combining the currently disclosed attack clues, it is suspected that the attackers first obtained breakthrough conditions from employee terminals, and then used the account authorization mechanism to complete subsequent asset transfers.

Currently, how exactly the employee computer was compromised, whether the attackers obtained signature credentials, and whether there are management vulnerabilities in the internal permissions still need further confirmation.

Multiple issuers involved, some assets frozen

After the incident occurred, institutions such as Tether, Circle, and Ripple participated in tracking related addresses and asset disposal, taking freezing measures on some involved assets.

As of October 30th, Binance disclosed that approximately $2.54 billion in related assets had been frozen, and the scale of freezing reported by external sources subsequently increased. Different institutions have varying statistical criteria and update times, and relevant numbers are still changing.

However, freezing does not equate to full recovery. Some assets can be restricted through issuer permissions, while assets like ETH cannot simply rely on issuers for freezing. Whether the attackers still hold other assets and whether they attempt to transfer or exchange them has also become a key focus of subsequent tracking.

Exchange security cannot only focus on on-chain

The real aspect of this incident that deserves attention may not just be the scale of asset transfers, but how the attackers were able to touch the core assets of the exchange step by step from devices routinely used by employees.

The security of hot wallets, private key management, employee terminal protection, internal permission isolation, and transaction signature review form a complete security chain. Any breach at any one link could render originally independent defense measures ineffective.

For exchanges, security boundaries do not only exist in servers and on-chain contracts but also in every office device that can access the internal system.

Currently, Binance still needs to further clarify the attack entry point, the scope of impact, and the final losses. Compared to the amounts of on-chain transfers, the market next needs to see the complete attack path and how the platform can prove that similar incidents will not happen again.

If you are also paying attention to the Crypto market and want to participate in trading or asset allocation, you can register through the following exclusive channels and enjoy the benefits:

Binance: Register through the exclusive link, fill in the invitation code aicoin668, and enjoy a 10% commission rebate.  

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=3

Benefits group: https://www.aicoin.com/link/chat?cid=gmLgwvKD1

OKX: Register through the AiCoin exclusive link to enjoy a permanent 20% commission rebate.  

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=2

Benefits group: https://aicoin.com/link/chat?cid=l61eM4owQ

Bitget: Register through the AiCoin exclusive channel to enjoy a 10% transaction fee rebate.

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=6

Benefits group: https://aicoin.com/link/chat?cid=N63yYYKQE

You are also welcome to join AiCoin-related communities to get more information on new coins and earning opportunities from exchanges:  

Official Telegram community: https://t.me/aicoin_support

AiCoin Chinese Twitter: https://x.com/AiCoinzh

The content of this article represents only the author's personal views and does not represent the position of this platform. The views, conclusions, and suggestions in the text are for reference by investors only and do not constitute any investment advice related to this platform. The market has risks; investment requires caution.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。