Linda Examines Binance Hack and Questions Surrounding the Attack

Cardano community creator Linda has examined the Binance security breach in a new video, questioning how attackers moved billions of dollars while reviewing the exchange’s response and the investigation into those responsible.

Her analysis follows Binance’s estimate that approximately $6.3 billion was affected by the October 29 attack. Linda also addresses speculation that the breach was an inside job, while presenting investigators’ findings that point toward a North Korean hacking group.

Questions About Binance’s Security Controls

Linda focuses on the initial suggestion that the breach may have involved a compromised laptop belonging to a Binance DevOps engineer. She questions how an attacker could gain access to systems capable of moving such a large amount and whether safeguards should have stopped the withdrawals sooner.

The video also includes a subsequent update from Binance CEO Richard Teng. In the statement Linda presents, Teng explains that investigators had identified additional points of breach and describes the incident as a complex attack.

According to that update, the attackers used mechanisms that destroyed tools and traces as they operated, making the investigation more difficult. The later findings indicate that the breach cannot be reduced to a single compromised laptop.

Linda also discusses Teng’s explanation of how the attackers obtained execution approval involving an internet-connected Binance wallet. The update refers to EIP-7702, an Ethereum mechanism that allows an account to delegate execution to smart contract code. According to the statement shown in the video, the delegation did not pass through Binance’s normal approval controls.

How the Attackers Moved the Funds

Linda describes a rapid sequence of transactions after the unauthorized withdrawals began on October 29. According to her account, most of the affected assets were moved in approximately 20 minutes.

Stablecoin issuers Tether and Circle began blocking addresses associated with the attackers. Such restrictions can prevent affected tokens from being moved further, although freezing assets is separate from recovering and returning them.

Linda explains that the attackers deposited stolen USDT into the Aave lending protocol and used it as collateral to borrow ETH. She also describes stolen stablecoins being exchanged for ETH before some receiving addresses were blocked.

ETH does not have a central issuer able to freeze tokens at an address in the same way as the issuers of USDT and USDC. Linda uses the transactions to show how attackers moved between assets while freezing efforts were underway.

Her video also highlights a Chainalysis observation that thousands of transactions appeared to circulate funds among addresses, sometimes returning them to addresses involved earlier in the sequence. Linda connects the pattern to automation and efforts to obscure the trail of funds.

Aave temporarily restricted new deposits and borrowing as a precaution. Linda notes that users could still withdraw funds and repay loans, while subsequent changes left USDT, USDC and several other assets with a zero loan-to-value ratio, preventing their use as collateral for new borrowing.

[NEWSBREAK]

Inside Job Speculation and the Investigation

Linda addresses online speculation that the breach may have involved insiders. She describes her questions about the scale of the theft and the initial focus on an employee’s laptop, but does not present evidence establishing an inside job.

She also examines findings pointing in another direction. According to the analysis presented in her video, blockchain intelligence firm TRM Labs attributed the attack to Trader Traitor, a group linked to North Korea. Linda describes the firm’s account of preparations that began at least 36 hours before the theft, including wallet setup and testing.

Linda references findings from Chainalysis and investigator ZachXBT concerning connections between funds from the Binance incident and an earlier Bitget hack associated with North Korean attackers. At the time of her recording, she notes, Binance had not officially confirmed who carried out the attack.

The video also covers Binance’s commitment to cover losses. In a statement shown by Linda, the exchange said it had reserved more than $6.34 billion of company funds, with around $5 billion already held in the same types of assets affected.

Binance has since begun restoring withdrawals in phases. On November 1, the exchange started reopening the service for a selection of assets and networks, with availability varying by token and blockchain.