Attackers transferred approximately $6.3 billion from 17 Binance hot wallets after compromising a DevOps laptop and reaching infrastructure capable of submitting transactions to Binance's signer. On Ethereum, 50 pre-obtained EIP-7702 authorizations enabled a malicious delegation that supported repeated withdrawals for nearly four hours without additional signatures. ThreatMon assesses attribution to DPRK-linked TraderTraitor as plausible with moderate-to-high confidence, based on multiple analytics firms, recurring signing-path tradecraft, and laundering overlap with Bitget proceeds. No government attribution had been issued, and Binance reported no evidence of private-key, customer-data, or KYC exposure.