Binance on Tuesday morning published its first account of how attackers took about $6.34 billion from its hot wallets on Oct. 29. The exchange calls the report initial and says independent security firms will review its findings.
How it happened. Binance describes a multi-stage campaign. In June, a wallet DevOps engineer installed a tampered copy of the Homebrew package manager while looking for an AI coding tool. Binance caught it, replaced the device and rotated credentials, but says the engineer’s role and his teammates had been exposed. In September, a second engineer was approached on a legitimate job platform. After two fake interviews, he ran a code “assignment” on his work computer that hid malware Binance’s endpoint tools missed.
On Oct. 20, the attacker used that machine and an internal AI tool to gain control over two wallet engineers, one of whom held a container deployment token. On Oct. 29, the attacker used those credentials to deploy a container and reach an internal wallet signing service. From there it could start transfers outside the normal withdrawal process.
The drain. From 4:05 to 4:09 p.m. ET, five hot wallets sent 233.46 million XRP to the attacker. SOL, OP and 18,270 BTC followed. On Ethereum, the attacker used the signing service to set up EIP-7702 delegations over a hot wallet, and they kept working after withdrawals were paused. Because the wallet used multi-party computation, there was no single key to cancel them, and Binance had to build a revocation procedure. The last unauthorized transfer settled at 7:56 p.m. ET. The delegation was cleared at 8:10 p.m.
Attribution and funds. Binance cites the FBI’s finding that North Korea is responsible. It says about $2.85 billion has been frozen or intercepted, and that it set aside more than 100% of the loss. It says 98% of affected tokens were replenished as of Oct. 31 and it is buying the less liquid remainder. Binance repeats that users will not bear the loss.
Next steps. Binance says it has rebuilt the wallet system and the AI tool, replaced devices and revoked credentials. It plans an independent review and a security research fund.
What it doesn’t answer. The report doesn’t explain why the signing service would sign transfers outside the withdrawal process, or how the AI tool gave the attacker control. It doesn’t say whether the June breach prompted a wider review. It gives no time zone for the Oct. 29 access window, and it has no chain-by-chain loss tally. It also doesn’t say how the 98% figure squares with the 95% Binance cited Sunday, or how frozen funds will be returned. It names no review firm and sets no date for a final report.
Sources: Binance Blog, FBI, Reuters