Crypto exchange breaches: how attackers reach the signing and withdrawal path

The largest crypto exchange thefts no longer start with a stolen private key: they start with an engineer's laptop and end with the exchange's own systems signing the attacker's transaction. Binance (October 2026, investigation ongoing), Bybit (February 2025) and DMM Bitcoin (May 2024) all followed a path through people, sessions, cloud and deployment access, and the software that prepares or approves withdrawals. BitMart (2021) shows the older pattern, a single hot wallet key with no second control. This guide reads those incidents side by side, lays a credentials overlay on the signing and withdrawal path (engineer endpoints, cloud sessions, CI, signing services, MPC policy), and turns the lessons into controls and metrics. It is for security, custody and platform engineering teams at exchanges, custodians and the wallet vendors that serve them. The control catalogue itself is in the Crypto Exchange Identity and Key Security Guide; this page goes deeper on how the incidents actually reached money.

Key takeaways

• Signing systems get used, not robbed. In Binance's initial findings there is no evidence of a private key leak, yet TRM Labs assesses that the attacker could make the hot wallet signing system sign transactions of its choosing.
• The laptop is inside the wallet boundary. Binance points to a compromised DevOps engineer's laptop; Bybit's loss began on a Safe{Wallet} developer's machine; DMM Bitcoin's began with a Ginco employee running a fake recruiter's test.
• Valid sessions beat MFA. Hijacked AWS session tokens (Bybit) and session cookie data (DMM Bitcoin) had already passed authentication, so login controls never saw the attack.
• Suppliers sit on the path. Two of the three largest cases were one step removed from the exchange's own estate: the attacker changed what a wallet vendor's software showed or sent.
• Speed is the attacker's advantage. TRM Labs reports most of the Binance outflow left in about 20 minutes across ten chains; controls that rely on a human noticing are too slow without automated withdrawal limits.

The signing and withdrawal path

An exchange withdrawal is a chain of systems, each with its own identities. An attacker does not need the key if it can control any earlier link and the later links trust it. Mapping the chain is the first exercise for any custody team.

The incidents side by side

The DMM Bitcoin details come from the FBI, DC3 and Japan National Police Agency attribution of December 2024, as summarised in the TraderTraitor (Jade Sleet) threat actor profile. The FBI attributed both DMM Bitcoin and Bybit (public service announcement of 26 February 2025) to North Korean activity it tracks as TraderTraitor.

Two other incidents on the site help with context rather than the signing path. The JumpCloud Breach (2023) shows a North Korean actor using a supplier's command framework to reach fewer than five customers' devices, the same supplier-first logic. The Coinbase Insider Breach (2025) touched no keys or funds, according to Coinbase, but gave criminals customer data for impersonation scams, a reminder that support tooling is a second path to customer money.

Binance 2026: what is confirmed so far

The investigation is ongoing and Binance has said a detailed post-mortem will follow, so treat this section as a snapshot checked on 2 November 2026.

• Binance's initial findings: a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorised withdrawal transactions; Binance says it found no evidence of a wallet private key leak, has "uncovered additional points of breach", suspended withdrawals and revoked authorisations for the affected address, as reported by BleepingComputer.
• Not one engineer's permissions: co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action", and that the investigation has not attributed responsibility to any individual, as reported by BleepingComputer.
• TRM Labs' on-chain view: about $6.36 billion left Binance wallets on ten blockchains from 20:05 UTC on 29 October 2026, most within about 20 minutes. On Ethereum, a single transaction carried 50 EIP-7702 authorisations signed by the hot wallet across 50 consecutive nonces, one of which matched and turned the wallet into a sweeper that only the operator could instruct. Signed transfers left the other chains in the same window. TRM's wording: "In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure."
• Attribution: TRM Labs attributes the theft to TraderTraitor "with high confidence"; BleepingComputer reports Chainalysis confirmed the finding. Binance has not attributed the attack.
• Freezes: TRM Labs reports about $2.7 billion frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council by 00:30 UTC on 30 October, with about $2.4 billion beyond issuer reach.

What is not yet known: how the laptop was compromised, what the additional points of breach were, and how the withdrawal service obtained signatures. Do not build controls on an assumed root cause. The lessons below hold whichever detail turns out to be true.

Credentials overlay: what each stage leaks

Lay every credential type over the path and ask what an attacker holding it could make the next stage do. This is where most exchanges find standing access they did not know about.

EIP-7702 is listed as Final on eips.ethereum.org. Its authorisation tuple signs a chain ID, a delegate address and a nonce; the delegation persists until replaced, a chain ID of 0 is valid on any chain, and the specification warns that delegated code has full access to the account. A custody signer that will sign arbitrary payloads can therefore be asked to give away the whole account in one signature. See the MPC Wallet and Threshold Signing Security Guide for policy engine design.

Lesson 1: engineer endpoints are signing infrastructure

Every large case started on an individual's machine. TraderTraitor's documented approach is a recruiter or collaborator persona and a coding task that runs on the target's device, and the FBI notes that several employees of the same company are often approached in parallel.

• Tier the people: anyone who can reach production wallet services, signer front ends, policy consoles or their deploy pipelines works from a privileged access workstation, not their everyday laptop. See the Privileged Access Workstations Guide.
• Isolate untrusted code: interview tests, sample repositories, Docker projects and npm packages from outside run in disposable virtual machines with no corporate credentials. See the Web3 Developer Operational Security Guide and the Developer Workstation and IDE Security Guide.
• Shrink credential residue: no long-lived cloud keys on disk, short CLI sessions, hardware-backed SSH keys, browser profiles separated for production consoles.
• Report lures: make a single report from one engineer trigger a check across the team, because parallel targeting is the documented pattern.

Lesson 2: sessions and the control plane need their own controls

Bybit's attackers failed to register their own MFA device and simply used the developer's live AWS sessions instead. Login MFA is necessary but not sufficient once a token exists.

• Short and bound: production role sessions of an hour or less, re-authentication with a hardware key for sensitive actions, and device-bound session approaches where your platforms support them. See the Session Hijacking and Cookie Theft Guide.
• Just-in-time production access: no standing write access to buckets, clusters or secrets that serve wallet components; time-boxed elevation with an approver.
• Watch the session, not just the login: alert when an existing session appears from a new network, a VPN exit or a different device fingerprint.

Lesson 3: the signer must not trust the caller

If the withdrawal service can ask for any signature, compromise of that service equals compromise of the key. Binance's initial description (a service container submitting unauthorised withdrawals, no key leak) is exactly the case a policy layer outside the caller is meant to stop.

• Independent policy: the signer or MPC policy engine enforces destination allowlists, per-transaction and per-window value limits, velocity limits and transaction type rules, using data the calling service cannot change.
• Refuse unusual transaction types: contract calls, approvals, delegation authorisations and batch payloads from a hot wallet should fail closed unless a named policy allows them.
• Cap the blast radius: hot wallet balances sized to expected withdrawals, with automatic halts when outflow per minute exceeds a threshold. Twenty minutes is too short for a human to read an alert.
• Verify what signers see: Bybit's signers approved a transaction their interface misrepresented. Approvers decode and compare the transaction on an independent device or tool before signing.

Lesson 4: suppliers are part of your path

Safe{Wallet} for Bybit and Ginco for DMM Bitcoin were the entry points, not the exchanges. Bybit stated that its own infrastructure was not compromised, and still lost the funds.

• Map supplier influence: list every vendor whose code, interface or service can change what is signed or where funds go: wallet software, MPC providers, node and RPC providers, front-end hosting, identity and device management.
• Contract for evidence: require front-end integrity controls, deploy approvals, session hardening and breach notification timelines from wallet vendors, and test them.
• Do not trust the vendor UI alone: independent transaction decoding is the control that survives a supplier compromise.

See the Web3 and Crypto Security Guide for the wider ecosystem view.

Decision guidance

Smaller exchanges and custodians usually depend on an MPC or custody vendor: focus on policy configuration (limits, allowlists, quorum on policy changes), hardware-key approvers, isolated test machines and supplier evidence. Large exchanges run their own signing platforms: add workload attestation between withdrawal services and signers, per-chain transaction type allowlists, automated outflow circuit breakers and red-team exercises that start from an engineer's laptop.

How to implement

1. Map the path (weeks 1 to 2): draw the seven stages for each chain you support, list every human and machine identity at each stage, and mark standing access.
2. Close direct routes (weeks 2 to 4): remove interactive exec into withdrawal workloads, long-lived cloud keys on laptops, and any service that can request signatures without policy checks.
3. Policy in monitor mode (weeks 4 to 8): deploy signer-side policy rules (destinations, value windows, transaction types including delegation authorisations) in log-only mode, compare against real traffic, tune.
4. Enforce with a rollback plan: switch rules to block per chain, starting with the highest-value hot wallets; keep a documented, two-person override for false positives rather than disabling the rule.
5. Endpoints and sessions: move tiered staff to privileged workstations, isolate external code, shorten sessions and enable just-in-time production access.
6. Drill: run a tabletop and a technical exercise that starts with a compromised DevOps laptop and measures time to halt withdrawals. Use the Web3 Incident Response Playbook for freezes, issuer contacts and communication.

Detection and measurement

• On-chain: outflow per minute per hot wallet, new destination addresses, delegation or set-code transactions from exchange wallets, unusual token approvals. BitMart's drain was first flagged by an outside firm.
• Signer and policy: every signature request with the calling identity, every policy decision, every policy or quorum change.
• Control plane: session reuse from new networks, exec into production containers, changes to wallet service images, front-end bucket writes.
• Endpoint: execution of unsigned code from downloaded repositories and containers on tiered machines, new persistence on engineer laptops.

Common failure patterns

• Protecting the key, not the signer: HSMs and MPC stop key theft but sign whatever an authorised caller asks; the Binance findings so far fit this gap.
• Trusting the screen: Bybit's signers approved a transaction the interface misrepresented.
• Coding tests on work machines: DMM Bitcoin's loss traced back to a Ginco employee running a fake recruiter's script.
• MFA as the finish line: stolen sessions bypassed MFA in both the Bybit and DMM Bitcoin cases.
• One key, full balance: BitMart's single stolen key controlled two hot wallets with no limit outside the key.
• Suppliers out of scope: wallet vendors treated as software purchases rather than identities on the money path.

Framework mapping

Practitioner checklist

• The seven-stage signing and withdrawal path is mapped per chain, with every human and machine identity listed.
• No service can obtain a signature without signer-side policy checking destination, value window and transaction type.
• Delegation authorisations, contract calls and batch payloads from hot wallets are blocked unless a named policy allows them.
• Hot wallet balances are capped and an automated circuit breaker halts withdrawals on abnormal outflow.
• Staff who can reach wallet tiers use privileged workstations, hardware keys and just-in-time access with short sessions.
• External code, interview tests and containers run only in disposable isolated environments.
• Treasury and cold wallet transactions are decoded independently of the vendor interface before approval.
• Every wallet supplier on the path has documented integrity, deploy and notification controls you have tested.
• A drill starting from a compromised engineer laptop has been run in the last 12 months, with time to halt measured.

Standards and references

• FBI: North Korea Responsible for $1.5 Billion Bybit Hack (PSA I-022625-PSA)
• Ethereum Improvement Proposals: EIP-7702 Set Code for EOAs
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
• NHI Mgmt Group: Binance Hack 2026 breach analysis
• NHI Mgmt Group: Bybit Hack 2025 breach analysis
• NHI Mgmt Group: BitMart Hot Wallet Hack 2021 breach analysis

Related NHI Mgmt Group resources: Crypto Exchange Identity and Key Security Guide · TraderTraitor (Jade Sleet) threat actor profile · MPC Wallet and Threshold Signing Security Guide · Privileged Access Workstations Guide · Web3 Incident Response Playbook