Key points
- Binance says attackers used a poisoned software download and staged recruitment over five months to gain internal access.
- Five hot wallets sent 233.46 million XRP during the Oct. 29 attack; delegated signing let transfers continue after withdrawals were suspended.
- Binance says it has frozen or intercepted about $2.85 billion and replenished 98% of affected tokens.
A Five-Month Intrusion Led to Binance Wallet Drains
Binance says the theft it values at $6.34 billion began months before assets moved. In its first public account of the Oct. 29 attack, the exchange described a campaign that paired a compromised software download with a staged hiring process, malware and misuse of an internal AI tool. The account shifts attention from a single moment of wallet compromise to a sequence of steps that exposed people, devices and credentials across the wallet engineering team.
The earliest foothold described by Binance dates to June, when a wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installer. Binance detected an anomaly, replaced the device and rotated credentials. But the incident also revealed the engineer’s responsibilities and the names of colleagues working on wallet infrastructure. The company’s response addressed the affected machine and access details, while the later account shows how that exposure may have informed further targeting.
In September, a second engineer was approached through a legitimate job platform by someone posing as a project director. Binance says the contact was followed by video interviews with people claiming to represent HR and company leadership; a personal social-media account was shared to build trust. The supposed CEO then assigned a code repository for installation on the engineer’s work machine. The staged process gave the malicious software a credible pretext for reaching a work device.
A Recruitment Process Became an Entry Route
The repository, Binance says, replaced a legitimate pyenv component with a malicious version and opened a connection to an attacker-controlled server. The malware was described as zero-day and was not flagged by endpoint tools at the time. That detail points to a practical weakness in relying on conventional device alerts alone: an apparently job-related coding task could deliver code that existing protections did not recognize as hostile. Binance has not disclosed all technical details of the intrusion.
On Oct. 20, the attackers used the compromised machine and an internal AI tool to reach two more wallet engineers, one of whom held a container deployment token. Binance says that on Oct. 29 the intruders logged into a third engineer’s computer, deployed a container using stolen credentials and began draining assets. The sequence illustrates how access gained through one employee can be extended through internal tools and privileges, although the company’s account does not specify every interaction between the targeted systems.
Binance says it blocked 57 other suspected North Korea-linked attempts this year that used similar lures, but the exchange did not make its own attribution of this theft. The FBI attributed the attack to North Korea; Pyongyang rejected that allegation, with Kim Yo Jong calling it a political provocation in state media. Those competing claims leave responsibility disputed in the public record. Binance’s report describes the method and timeline without resolving the attribution question itself.
Delegated Signing Prolonged the Response
The transfers began quickly on Oct. 29. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address, followed by about 970,500 SOL and 44.2 million OP from wallets on Solana and Optimism. A Binance hot wallet then sent 18,270 BTC. The scale and speed of these movements show why the response required more than identifying compromised credentials: the exchange also had to halt channels that could authorize on-chain transfers.
Binance says the attackers used a compromised signing service to invoke Ethereum’s EIP-7702, which permits an account to delegate execution rights to a smart contract without exposing its key. An attacker-controlled contract gained partial control of a Binance hot wallet. Suspending withdrawals did not close that route, because the attackers had submitted 50 signing transactions establishing on-chain delegations that operated outside the withdrawal infrastructure. The episode exposed a gap between familiar withdrawal controls and delegated execution.
The wallet used multi-party computation, so Binance says there was no single key that could simply be revoked to cancel the delegations. The team had to develop a procedure during the incident. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC; Binance cleared the delegation at 00:10 UTC on Oct. 30. The company acknowledged that the challenge lengthened containment and said it is reviewing signing-policy coverage and hot-wallet controls. The report does not detail the new procedure.
Recovery, Security Changes and Unresolved Questions
Binance reported freezing or intercepting about $2.85 billion of the stolen assets and replenishing 98% of affected tokens from its own funds, with the remaining balance being bought on the open market. These figures describe the exchange’s recovery and customer-restoration response, not a complete public accounting of every asset’s final destination. The company also said withdrawals resumed in stages, with dozens more assets across nine networks reopened on Tuesday after earlier restrictions.
Customer flows offered another measure of the immediate aftermath. Binance said users withdrew $10.97 billion during the 46 hours after withdrawals reopened Sunday, while net outflows were $5.28 billion. By 03:00 UTC, hourly deposits exceeded withdrawals, which co-CEO Richard Teng described as stabilization. The figures indicate that substantial withdrawals continued even as the hourly balance turned positive; they do not establish how users will behave over a longer period or whether confidence has fully recovered.
Binance says it rebuilt its wallet system and internal AI tool in new environments, replaced affected devices, revoked the engineers’ credentials and expanded behavioral anomaly detection. It is commissioning an independent review, increasing endpoint and developer-environment security spending, and planning an AI-security research fund with outside firms. In Washington, CFTC Chairman Michael Selig used the breach to argue for a federal registration path for offshore exchanges. The review’s findings and Binance’s fuller technical disclosures remain outstanding; some details will stay private.
Source: BitcoinMagazine
