The $6.34 billion theft from Binance began with a fake job interview and ran for five months before a single coin moved, the exchange said Tuesday in its first public account of the Oct. 29 attack.
Another initial incident report from Binance, released alongside a media briefing by co-CEO Richard Teng and chief security officer Jimmy Su, describes a campaign that combined a poisoned software download, a staged recruitment process, malware that evaded endpoint detection and an internal AI tool the attackers turned against the company’s own wallet engineers.
Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance being bought on the open market.
“This wasn’t one mistake or one breach — it was a months-long campaign,” Teng wrote on X. “We’re publishing the full report because the lessons go far beyond Binance.”
The FBI has attributed the attack to North Korea. Binance’s report cites that finding but stops short of its own attribution. Pyongyang rejected the claim Monday, with Kim Yo Jong, sister of leader Kim Jong Un, calling it a “grave political provocation” through state media.
The Binance hack had five months of preparation
According to Binance, the first foothold for this hack came in June. A wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installer.
Binance’s security team caught the anomaly, replaced the device and rotated credentials, but the episode exposed the engineer’s role and the names of colleagues on the wallet infrastructure team.
In September, a second engineer was approached on a legitimate job platform by someone posing as a project director. A video interview with a purported HR representative followed, with the interviewer sharing a personal social media account to build trust. A second interview with a supposed CEO ended with an “assignment”: a code repository the engineer was told to install on his work machine.
The repository replaced a legitimate pyenv component with a malicious version and opened a channel to an attacker-controlled server. Binance said the zero-day malware was not flagged by its endpoint tools at the time.
On Oct. 20, the attackers used that machine and an internal AI tool to reach two more wallet engineers, one of whom held a container deployment token. On Oct. 29, between 17:15 and 19:56 UTC, they logged into a third engineer’s computer, deployed a container with the stolen credentials and launched the drain. Binance said it blocked 57 other suspected North Korea-linked attempts this year using similar lures.
Four hours to contain
The money left fast. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address. Wallets on Solana and Optimism followed with about 970,500 SOL and 44.2 million OP. A Binance hot wallet then sent 18,270 BTC.
The attacker used the compromised signing service to invoke Ethereum’s EIP-7702, which lets an account delegate execution rights to a smart contract without exposing its key, and gave an attacker-controlled contract partial control of a Binance hot wallet.
Suspending withdrawals did not stop that last channel. The attackers had submitted 50 signing transactions to establish on-chain delegations that operated outside Binance’s withdrawal infrastructure. Because the wallet used multi-party computation, no single key existed to revoke them, and the team had to build a procedure on the spot. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC.
Binance cleared the delegation at 00:10 UTC on Oct. 30.
The report acknowledges the gap. “These challenges extended the time required to fully contain the unauthorized asset movements,” it says, adding that the company is reviewing its signing policy coverage and hot wallet controls.
Customers withdrew $10.97 billion in the 46 hours after withdrawals reopened Sunday, with net outflows of $5.28 billion, according todata Teng shared Tuesday. By 03:00 UTC hourly deposits exceeded withdrawals, a shift Teng called a sign of stabilization. Binance reopened withdrawals for dozens more assets across nine networks on Tuesday.
The breach has become a talking point in Washington. CFTC Chairman Michael Selig said the hack “proves our exact point” about the need for a federal registration path for offshore exchanges, and on Tuesday the agency cleared equity perpetual futures for U.S.-regulated venues, extending the onshoring push it began with Kalshi’s bitcoin perp in May.
Binance said it has rebuilt the wallet system and the internal AI tool in new environments, replaced affected devices, revoked the engineers’ credentials and expanded behavioral anomaly detection.
It is commissioning an independent review, raising spending on endpoint and developer-environment security and planning a research fund on AI security with outside firms. Some technical details, the report says, will stay private.