Binance has disclosed new details of a months-long cyberattack that led to the theft of approximately $6.34 billion in cryptocurrency on Oct. 29, saying hackers used fake job interviews, compromised developer tools and internal artificial intelligence systems to reach its wallet infrastructure.
In a report published Tuesday, the exchange described a campaign that began as early as June and culminated in unauthorized transfers across multiple blockchains. Binance said attackers exploited access to an internal wallet-signing service, bypassing normal withdrawal procedures.
How the attackers gained access
The investigation identified several stages. In June, a wallet engineer downloaded a compromised version of the Homebrew software installer while trying to install an AI coding tool. Binance said its security team detected the threat, replaced the employee's device and changed associated credentials, but the incident exposed information about its wallet infrastructure personnel.
A more consequential breach followed in September, when another Binance engineer was approached through a legitimate employment platform by someone posing as a recruiter. The employee took part in two interviews, including a video call with a purported human resources representative and another with someone claiming to lead a fictitious company.
During the second interview, the employee was instructed to download a coding assignment containing malicious software onto a work computer. The malware replaced a legitimate developer tool component, allowing attackers to execute commands and communicate with an external server. Binance said the previously unknown malware evaded its security software while attempting to conceal evidence of the compromise.
On Oct. 20, the attackers used the compromised device and an internal AI tool to gain access to two additional engineers, according to Binance. They subsequently obtained credentials allowing them to deploy software within the exchange's wallet infrastructure.
Wallet-signing access and EIP-7702
On Oct. 29, the attackers used those credentials to access wallet-signing operations and initiate unauthorized transfers involving 18,270 BTC, 233.46 million XRP, approximately 970,500 SOL and 44.2 million OP, among other assets.
Binance said the hackers also exploited Ethereum's EIP-7702 authorization mechanism, which allows smart contracts to execute transactions on behalf of an account. By establishing malicious authorizations, they gained the ability to move assets from a Binance hot wallet even after the exchange suspended normal withdrawals.
The attackers submitted 50 signing transactions to manipulate the account's transaction sequence and establish those permissions, Binance said. The exchange's use of multiparty computation technology complicated efforts to revoke the authorizations, requiring a specialized procedure to regain control. The last unauthorized transfer, involving approximately 2,962 ETH, was finalized shortly before midnight UTC on Oct. 29, and Binance revoked the malicious delegation shortly afterward.
Attribution and recovery
The findings expand on earlier comments from Binance co-CEO Richard Teng, who said the operation involved multiple breach points and evidence-destruction techniques rather than a single compromised employee.
Binance cited the FBI's attribution of the attack to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis separately linked the theft to North Korean hacking operations, while North Korean leadership has denied the accusations, calling the FBI statement a "political provocation."
Binance said approximately $2.85 billion in stolen assets had been frozen or intercepted as of its latest update. The company has committed to covering the financial impact itself and reported that 98% of affected token assets had been replenished as of Oct. 31, with purchases continuing for less liquid cryptocurrencies.
The exchange said it has rebuilt affected wallet systems, replaced compromised employee devices, revoked exposed credentials and expanded its AI-powered security monitoring. It is also commissioning an independent cybersecurity review and exploring a security research fund focused on threats involving artificial intelligence.
Investigators continue tracking the stolen funds. Blockchain analytics firm Elliptic traced the assets through approximately 12,000 wallets across 11 blockchains in less than four days, Bitcoin.com News reported Monday. Binance said its investigation remains ongoing and that some technical findings will undergo independent verification before additional information is released.
