Both were record crypto thefts attributed by the FBI to North Korea's TraderTraitor activity, and both began with a compromised developer or engineer machine. Bybit lost about $1.5 billion in February 2025 after a Safe{Wallet} developer's machine was used to tamper with transaction signing. The Binance hack, at about $6.3 billion, went through access to a service container that submitted withdrawals.
How the two incidents differ in access path
The key difference is the path to withdrawal control, not the underlying motive. In the Bybit case, the compromise began with a developer workstation and used session material to tamper with signing, so the attack was aimed at the transaction approval layer. In the Binance case, the compromise reached a service container that could submit withdrawals, which makes the abuse look more like direct operational control over the payout path.
That distinction matters because an attacker does not need the same level of access in both cases. One path manipulates the trust chain around signing, while the other abuses a system component already able to execute withdrawals.
In practice, the first question is whether the attacker touched the signing workflow, the withdrawal workflow, or both. That determines which logs, hosts, identities, and controls you prioritise first.
Why the control failure matters differently
Bybit exposed weakness in how privileged session material from a developer endpoint can be used to alter signing behavior. Binance exposed weakness in how a service-side component with withdrawal capability can be reached and abused. Both are identity and access failures, but they fail at different layers of the exchange stack.
The first case points to trust in a developer environment that should not have been able to influence production signing without strong verification. The second case points to a service path that appears to have had too much effective authority for a compromised component.
For a practitioner, this means the blast radius is shaped less by the headline loss and more by where the compromised access sat in the transaction chain. A developer machine compromise and a service-container compromise require different containment assumptions.
What the comparison tells you about response priorities
Although both incidents were linked to North Korea's TraderTraitor activity, the response playbook diverges once you identify the compromised hop. With Bybit-style tampering, the priority is to verify signing integrity, inspect developer and build environments, and confirm whether transaction approval logic was altered. With Binance-style unauthorized withdrawals, the priority is to review service execution paths, withdrawal authorization, and any automation that could move funds without sufficient human or policy checks.
Both incidents also show why exchange security cannot stop at wallet custody alone. A stolen or abused credential is only one part of the problem if the surrounding system allows that access to influence signing, withdrawal submission, or both.
That is why a good incident review asks not only “which account was compromised?” but also “what authority did that account or session unlock at runtime?”
Risk and Threat Considerations
These cases show how a compromise can pivot from one trusted environment into a high-value control plane. When developer endpoints, session tokens, or service containers can influence signing or withdrawal logic, attackers can turn routine operational access into direct financial theft.
Failure mechanism: A trusted workstation, session, or service component is abused to cross a trust boundary and perform actions that should have required stronger verification or narrower privilege.
Impact: Once that boundary fails, attackers can tamper with transaction approval, submit unauthorised withdrawals, and move quickly before detection or manual intervention closes the window.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | The cases hinge on abused legitimate access to trusted systems and sessions. |
| Recommendation — Hunt for abuse of legitimate accounts and sessions that can reach signing or withdrawal systems. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Session tokens and credential material were central to the compromise path. |
| AC-6 — Least Privilege | The incidents show how excess effective authority widens blast radius after compromise. | |
| Recommendation — Enforce short-lived, tightly managed authenticators for privileged systems and service paths. Restrict service and user permissions so a single compromised endpoint cannot move funds. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Service containers and signing-related non-human access can become high-impact abuse paths. |
| NHI-02 — Secret Leakage | The attacks involved compromised session material and trust in sensitive access artifacts. | |
| Recommendation — Reduce non-human privilege to the minimum needed for each withdrawal and signing workflow. Protect and rotate secrets and session material that can alter signing or payment flows. | ||
Practitioner Guidance
What to verify: Confirm which layer was actually compromised, the developer endpoint, the signing workflow, or the withdrawal service, because the containment scope changes with each one. Review whether the compromised path could reach production without step-up verification, policy enforcement, or separate approval gates.
Decision rule: If the compromise touched a signing or withdrawal path, treat the event as a control-plane incident, not just an endpoint incident. That means preserving evidence from hosts, sessions, service logs, and approval records before you assume the loss is fully understood.
Practitioner takeaway: The important distinction is not “which exchange lost more,” but whether the attacker stole authority at the signing layer or at the execution layer, because that determines both the likely attack path and the controls that failed.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org