Binance says the hackers behind last week’s $6.34 billion theft reached its wallet signing systems after a months-long campaign that compromised three engineers’ computers, one of them through a fake job interview.
The exchange published its initial incident report on November 3. Roughly $2.85 billion of the stolen assets has been frozen or intercepted.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.
The FBI has blamed the theft on TraderTraitor, a North Korean state-sponsored hacking group.
How the attack unfolded
According to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.
The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.
Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.
In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.
During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.
The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.
“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.
On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.
The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.
Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.
“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.
The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.
Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.
The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.
Other developments
North Korea has rejected the FBI’s attribution of the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.
[ Read: North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims ]
Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now been replenished.
Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.
On the laundering front, Elliptic says the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarily slowed the laundering.
Related: Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
Related: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
