Binance details months-long path to $6.34B wallet breach
Binance says attackers chained malware, fake interviews and an internal AI tool to reach wallet signing systems; $2.85 billion was frozen or blocked so far.
The Top Crypto Editors 2 min read
How did attackers reach Binance’s wallets? In a preliminary report published Nov. 3, the exchange described a months-long campaign that used malware, fake recruitment interviews and an internal AI tool to reach its wallet-signing systems. The incident involved digital assets worth about $6.34 billion, Binance said in its investigation update.
How did the attack move from a fake interview to wallet access?
Binance says an engineer downloaded a tampered Homebrew installer in June while trying to install an AI coding tool, exposing information about the engineer’s role and colleagues. In September, attackers posing as recruiters tricked another engineer into downloading a malicious coding assignment onto a work computer. On Oct. 20, they used that compromised computer and internal AI tools to access two other engineers’ devices, including one with container deployment permissions.
On Oct. 30, Binance says, stolen credentials let the attackers deploy a container and run a script against its wallet operations. The Block’s report on Binance’s findings says the sequence led to access to wallet infrastructure and unauthorized transactions. Binance says it detected and prevented 57 suspected North Korea-linked cyber threats during 2026, though that figure covers other incidents too.
Why didn’t pausing withdrawals stop the transfers?
Binance says attackers used Ethereum’s EIP-7702 authorization mechanism to give a contract they controlled partial execution permissions over affected hot wallets. Those on-chain permissions could continue operating outside the exchange’s normal withdrawal system, so suspending withdrawals alone did not stop transfers. Binance says multi-party computation controls also meant there was no single private key it could use to revoke the permissions immediately.
What has Binance done, and what comes next?
Binance says it closed the entry points, rebuilt affected systems, replaced devices and strengthened wallet controls. It reported that about $2.85 billion had been frozen or blocked, and that 98% of affected token assets had been replenished as of Oct. 31. The exchange says it will cover the losses and commission an independent cybersecurity review; that review’s findings are the next thing to watch.
References
- investigation update — binance.com
- report on Binance’s findings — theblock.co