Binance is still piecing together how hackers made off with an estimated $6.3 billion in crypto , but investigators have already identified two important parts of the story: the attack has been linked to North Korea’s TraderTraitor hacking group, and an Ethereum upgrade gave the attacker a way to empty one of the exchange’s largest hot wallets in a single transaction.

The theft unfolded across 10 blockchains yesterday, with most funds leaving Binance-controlled wallets in roughly 20 minutes, according to a report from TRM Labs. Binance initially pointed to a single compromised DevOps engineer’s laptop, but later said there were additional points of breach in a complex attack process.…