Statements

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

Binance has set aside more than $6.34 billion in company funds to cover losses from the hack, the exchange said. The company said $5 billion of those funds were already held in the same tokens affected by the attack.

The attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens, Bitquery added.

According to Bitquery, 17 of the attackers’ Bitcoin addresses held 1,000 BTC each, while the remaining coins sat in two other wallets.

Blockchain analytics firm Bitquery traced 18,270 Bitcoin (BTC), worth roughly $1.4 billion, to 19 addresses linked to the attacker.

“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.

Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.

Approximately $2.8 billion has been frozen so far.

Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.

In a series of posts, Yi He, Binance's co-chief executive, thanked various cryptocurrency issuers for freezing the assets. "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said.

Check Point's Dave said this attack also resembled a hack on crypto exchange platform Bitget in September in which $388m (£289m) was lost: "This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them."

Chainalysis, a crypto analytics firm, also said it has "high confidence" that the North Korean group are linked to the hack.

The lab's global head of policy Ari Redbord told the BBC the Binance hack is a "watershed moment" that is unlike anything the industry has seen. The attacker still holds an enormous sum of stolen assets, meaning efforts to trace and recover the funds are far from over, Redbord added.

Check Point's chief information security officer Jayant Dave said the losses estimated by Binance made it "the largest crypto theft on record".

in which $388m (£289m) was lost

Binance co-founder Changpeng "CZ" Zhao thanked the two issuers for their "quick freeze."

Issuers had frozen $2.80 billion of it, but $2.9 billion in Ethereum Ethereum, Bitcoin Bitcoin, Tron , Solana and other tokens could still be moved, according to Arkham.

"We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified—and publish an updated Proof of Reserves once remediation is complete," Teng wrote.

Outflows stopped when it paused withdrawals, and it remains on track to resume them in 45 hours, the exchange said.