The attackers who drained over $6.34 billion from Binance’s hot wallets on October 30 worked for five months, and one of the key steps was going through the exchange’s own internal AI tools. That’s the picture in Binance’s preliminary investigation results, which trace the breach from a poisoned software download in June to a single early morning session in which attackers signed transfers of billions. They also explain why disable exit was not enough to close it Attacker out: part of their access had already been written to the Ethereum blockchain.
Binance says it has frozen or blocked about $2.85 billion so far and will cover the rest itself. “Binance will cover the full amount of the stolen funds, not our users. wrote the exchange. Citing the FBI’s latest information, North Korea admitted.
The first football came in June. An engineer on the Binance wallet development and operations team, whom the report calls Engineer A, searched online for a popular AI coding tool and downloaded a tampered homebrew installer. Binance’s security team saw the anomaly, replaced the laptop and rotated the engineer’s credentials.
That cleaning came too late for one thing. The role of engineer A and the details about the colleagues in the wallet infrastructure team were already leaked.
A two-round job interview, then a coding assignment
In September, a second engineer (engineer B)whose public profile Binance mentioned was on a legitimate work platform by someone posing as a project director. What followed was balanced. The first round was a Live video call with a fake HR representativewho shared a social media account full of personal photos and videos to look genuine. The second was held on a messaging app with someone claiming to be the CEO of a company that doesn’t exist.
Then came the take-home test. Engineer B was asked to download a code repository for a”assignment“, and set it up run maliciously Code. The malware has a part of pyenva widely used tool to manage Python Versions, for a educated copy that executed commands and talked to a server that controlled the attacker.
Binance admits its endpoint security software didn’t catch it. The company describes the malware as zero-day and says the attackers also hid their activity and erased their tracks.
On October 20, the perpetrators used Engineer B’s infected computer to take over Engineer A’s machinesthese people third employee, Engineer Cvia Binance’s internal AI tools. Binance did not say what those Tools are or exactly how they were abused, only that it has since built them up and tightened their access controls.
On engineer A’s machine, the attackers found what they needed: a token with permission to install containers.
Seven o’clock in the morning of October 30
The theft itself happened overnight. Between 1:15 in the 3:56 in (UTC+8) in October 30which attackers log Engineer C’s computer, used Engineer A stole credentials to deploy a container, and run a malicious script in it. That gave them access to Binance’s internal wallet signing service, which let them skip the normal withdrawal checks entirely.
The trip started at 4:05 am. Over four minutessent five hot wallets 233.46 Millions XRP to Attacker Addresses. Hot wallets open Solana in the Optimism sent approx 970,500 SOL 44.2 Millions OPand and 18,270 BTC left too.
Op Ethereumthe attackers took a different route. They pushed through 50 signed transactions to manipulate account numbers and set up delegations under EIP-7702, an Ethereum upgrade that lets a regular account have some execution rights to a smart contract without giving up its private key. Here the contract belonged to the attacker.
That alone was not enough to stop the withdrawal. The malicious authorizations were already recorded on the chain, so they remained valid whatever Binance did on its own platform. Extracting them wasn’t a one-click job either, because the wallets use multi-party computing (MPC) signatures, where no single private key can withdraw anything. Binance had to perform a special withdrawal process. The last unauthorized transfer, 2,961.9 ETH, was confirmed at 7:56 a.m., and at 8:10 a.m. Binance removed the EIP-7702 delegation from its Binance14 Hot wallet.
Who pays, and what changes
Binance says it has kept reserves on top 100% of the stolen amount, and that 98% of affected token balances have been replaced by October 31st, which users can check on its Proof of Reserves page. It still buys back some of the less liquid tokens. Those $2.85 billion frozen figure iis still verified and could move with market prices.
Since the attack, Binance says it rebuilt the affected wallet systems in a fresh environment, replaced the compromised devices, disabled the associated credentials and tokens, and scanned all employees. device. It has also introduced stricter risk controls for its wallet services and more AI-based detection of unusual behavior. An independent cyber security firm will review the incident, and the investigation is still open.
For scale, Bybit is about $1.5 Billion loss in February 2025, also blamed on North Korea, was the largest crypto theft on record. Binance’s figure is about four times that. The exchange says it detected and stopped 57 other suspected North Korea-related attacks this year before this one went through.