Binance said on Nov. 3 that hackers used fake job interviews, malicious software, and a compromised internal AI tool to access its wallet systems and steal $6.34 billion on Oct. 29.
Summary
- Attackers used compromised employee computers and stolen deployment credentials to reach Binance’s wallet signing infrastructure.
- Malicious Ethereum authorizations allowed transfers to continue after Binance suspended its normal withdrawal services.
- Binance says approximately $2.85 billion has been frozen or intercepted, with customer losses covered.
- Experts expect stronger demand for custody safeguards, while cautioning that regulated platforms still face risks.
According to Binance’s initial incident report, the attack developed over several months, combining employee deception with compromised software and unauthorized access across internal systems.
The exchange said it had replenished 98% of affected token assets by Oct. 31 and was purchasing the remaining, less liquid cryptocurrencies. CEO Richard Teng said withdrawals had broadly resumed and users would bear no losses.
Binance attackers moved from developer tools to wallet systems
The report traces an early encounter to June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Security staff detected the anomaly, replaced the device and rotated related credentials.
However, Binance said the encounter exposed the engineer’s role and colleagues working on wallet infrastructure.
In September, a second engineer was approached through a legitimate recruitment platform by someone posing as a project director. A video interview with a purported human resources representative was followed by another interview with the supposed CEO of a fictitious company.
Near the end, the engineer was instructed to download an assignment repository onto a work computer. Malicious code ran during setup, replacing the legitimate pyenv development tool with a compromised version.
Binance described the malware as previously undetected by its endpoint security tools and said it concealed activity and removed traces.
On Oct. 20, the attacker used the compromised computer and an internal AI tool to gain control over two wallet engineers’ computers. One held a container deployment token.
Days later, on Oct. 29, the attacker used those stolen credentials to deploy a container and run a malicious script that reached wallet signing operations.
Ethereum permissions kept transfers running after withdrawals stopped
Between 20:05 and 20:09 UTC on Oct. 29, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address, according to the report. Other wallets sent approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
The attacker then used the signing service to establish malicious permissions through Ethereum’s EIP-7702 mechanism, which allows a wallet to delegate execution to smart contract code.
Earlier wallet attack findings explained how the attacker used Ethereum’s EIP-7702 feature to give a malicious smart contract permission to move funds from Binance’s hot wallet known as Binance 14.
Binance said suspending withdrawals could not invalidate permissions already established on Ethereum. Its multiparty computation wallet required a specialized procedure to revoke them because no single private key was available for an immediate revocation.
The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC after previously being broadcast and remaining pending. Binance cleared Binance 14’s delegation at 00:10 UTC on Oct. 30.
In an Oct. 31 alert, the FBI attributed the theft to North Korea’s TraderTraitor activity. The agency said it was working with the U.S. Secret Service and IRS Criminal Investigation and urged service providers to block transactions connected to identified addresses.
Experts see adoption continuing, with custody protections in focus
Joe Sticco, co-founder and CEO of Cryptex Finance, told crypto.news he did not expect the incident to cause a years-long setback for adoption.
He pointed to actions by Tether, Circle and DeFi protocols to freeze affected assets as evidence that industry participants could coordinate during major disruptions. Sticco expects the incident could increase demand for regulated exchanges and stronger custody practices, including cold storage.
James Butterfill, head of research at CoinShares, emphasized the legal protections attached to custody.
“The incident highlights why the legal framework governing custody matters. MiCA provides materially stronger safeguards for clients of authorised entities such as Coinbase Luxembourg, including segregation of customer assets and liability for custody losses caused by incidents attributable to the provider,” Butterfill told crypto.news.
“These protections strengthen accountability, but authorisation cannot prevent every hack, shield investors from market losses or provide a general investor compensation scheme.”
Butterfill added that regulated crypto custody offers stronger protections without making holdings equivalent to bank deposits covered by a deposit guarantee scheme.
Binance rebuilds affected systems and commissions reviews
Binance said approximately $2.85 billion had been frozen or intercepted, subject to reconciliation and market price changes. Its earlier recovery commitment allocated more than the full estimated loss to replacing affected assets.
The exchange said it rebuilt the affected wallet environment and internal AI tool, replaced compromised devices, decommissioned credentials and scanned employee devices.
Binance is engaging independent cybersecurity firms to review the incident, and plans increased spending on developer security, endpoint protection and behavioral monitoring.
