Bonanza Factory Says Binance Hack Exploited Internal Approval System

The hack of Binance, the world’s largest digital-asset exchange, may have been carried out by exploiting the exchange’s internal withdrawal system, according to an analysis released on Oct. 30.

Bonanza Factory, a South Korean blockchain analytics firm, published the on-chain findings through Transight, its blockchain tracking team, on Oct. 30.

Transight said at least nine Binance hot wallets across multiple networks, including Ethereum, Arbitrum and Avalanche, were attacked over roughly 20 minutes. The attack appeared to slip in among Binance’s legitimate withdrawal transactions. Transaction fees and transfer routes also showed patterns different from normal withdrawals.

Bonanza Factory said the attacker may have abused internal signing authority rather than stolen private keys. “The attacker appears to have obtained valid signatures from Binance’s internal signing path and then used them for transactions the attacker constructed directly,” the firm said. “That means assets could be stolen by abusing internal signing authority without taking private keys.”

The firm also said it found signs of a link to a North Korean hacking group. Bonanza Factory said funds stolen in the Binance hack were mixed through the same wallet address, via THORChain, with funds taken in the Bitget hack in September. The Bitget breach had previously been attributed to TraderTraitor, a group linked to North Korea.

Global blockchain analytics firms including TRM Labs and Chainalysis had also previously pointed to North Korea as being behind the attack.

Bonanza Factory said it has not determined how the attacker gained access to Binance’s internal transaction approval system. Further analysis is needed to identify the specific intrusion route and whether internal data was leaked.