Key Takeaways
- Binance detailed a months-long cyberattack that led to the theft of approximately $6.34 billion in cryptocurrency on Oct. 29, with hackers using fake job interviews, malicious software, and compromised AI tools to infiltrate internal systems.
- Attackers exploited wallet-signing infrastructure and Ethereum’s EIP-7702 mechanism to steal billions in assets, including bitcoin, XRP, and solana. The FBI and blockchain intelligence firms attributed the attack to North Korean hackers.
- Binance said approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of affected token assets had been replenished as of Oct. 31.
Compromised Software and Social Engineering
In a report published Tuesday, Binance outlined a months-long campaign that began as early as June and culminated in the Oct. 29 theft. The exchange said the attackers exploited access to an internal wallet-signing service, bypassing normal withdrawal procedures to move billions of dollars across multiple blockchains.
The investigation identified several stages of the attack, including an earlier attempt in June when a wallet engineer downloaded a compromised version of the Homebrew software installer while attempting to install an AI coding tool. Binance said its security team detected the threat, replaced the employee’s device and changed the associated credentials, but the incident exposed information about its wallet infrastructure personnel.
A more consequential breach followed in September, when another Binance engineer was approached through a legitimate employment platform by someone posing as a recruiter. The employee participated in two interviews, including a video call with a purported human resources representative and another with someone claiming to lead a fictitious company.
During the second interview, the employee was instructed to download a coding assignment containing malicious software onto a work computer.
The malware replaced a legitimate developer tool component, allowing attackers to execute commands and communicate with an external server. Binance said the previously unknown malware evaded its security software while attempting to conceal evidence of the compromise.
On Oct. 20, the attackers used the compromised device and an internal AI tool to gain access to two additional engineers. They subsequently obtained credentials allowing them to deploy software within Binance’s wallet infrastructure.
On Oct. 29, the attackers used those credentials to access wallet-signing operations and initiate unauthorized transfers involving 18,270 BTC, 233.46 million XRP, approximately 970,500 SOL, and 44.2 million OP, among other assets.
The hackers also exploited Ethereum’s EIP-7702 authorization mechanism, which allows smart contracts to execute transactions on behalf of an account. By establishing malicious authorizations, they gained the ability to move assets from a Binance hot wallet even after the exchange suspended normal withdrawals.
Binance said the attackers submitted 50 signing transactions to manipulate the account’s transaction sequence and establish those permissions. The exchange’s use of multiparty computation technology complicated efforts to revoke the authorizations, requiring a specialized procedure to regain control.
The last unauthorized transfer, involving approximately 2,962 ETH, was finalized shortly before midnight UTC on Oct. 29. Binance revoked the malicious delegation shortly afterward.
Binance Bounces Back From Record Hack
The findings expand on earlier Bitcoin.com News coverage of comments from Binance co-CEO Richard Teng, who said the operation involved multiple breach points and evidence-destruction techniques rather than a single compromised employee.
The exchange also cited the FBI’s attribution of the attack to North Korea. As previously reported by Bitcoin.com News, blockchain intelligence firms TRM Labs and Chainalysis separately linked the theft to North Korean hacking operations. North Korean leadership has since denied those accusations, calling the FBI statement a “political provocation.”
Binance said approximately $2.85 billion in stolen assets had been frozen or intercepted as of its latest update. The company has committed to covering the financial impact itself and reported that 98% of affected token assets had been replenished as of Oct. 31, with purchases continuing for less liquid cryptocurrencies.
The exchange said it has since rebuilt affected wallet systems, replaced compromised employee devices, revoked exposed credentials, and expanded its AI-powered security monitoring. It is also commissioning an independent cybersecurity review and exploring a security research fund focused on threats involving artificial intelligence.
The recovery comes as investigators continue tracking stolen funds. Bitcoin.com News reported Monday that blockchain analytics firm Elliptic traced the stolen assets through approximately 12,000 wallets across 11 blockchains in less than four days.
Binance emphasized that its investigation remains ongoing and that some technical findings will undergo independent verification before the company releases additional information.
