In this article5 sections
Binance has published an initial account of the October 29 theft of roughly $6.34 billion, saying the attackers reached its wallet-signing systems through a staged job interview, malicious software and a compromised internal AI tool. According to Bitcoin.com News, the exchange described a campaign running for months before the unauthorized transfers.
The FBI has attributed the operation to North Korea, and blockchain intelligence firms TRM Labs and Chainalysis separately linked the theft to North Korean hacking groups, Bitcoin.com News reported. North Korean leadership has rejected the accusation, calling the FBI statement a political provocation.
Also read: Binance SAFU Bitcoin Wallet Falls to 7,500 BTC After Hack Payout
Key facts
- The campaign began in June, when a wallet engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool; Binance replaced the device and rotated credentials.
- In September, a second engineer was approached on a legitimate recruitment platform by someone posing as a recruiter, then was told during a second interview to download a coding assignment that carried previously undetected malware.
- On October 29, stolen credentials were used against wallet-signing operations to move 18,270 BTC, 233.46 million XRP, about 970,500 SOL and 44.2 million OP, among other assets.
- Attackers used Ethereum’s EIP-7702 authorization mechanism to keep moving funds from a hot wallet after withdrawals were suspended, filing 50 signing transactions to establish the permissions.
- Binance said about $2.85 billion had been frozen or intercepted and that 98% of affected tokens were replenished as of October 31.
From a coding test to wallet signing
Binance’s timeline shows how ordinary developer tooling became the entry point. The June installer incident did not lead to loss but exposed which staff worked on wallet infrastructure and who their colleagues were. The September interview — a video call with a purported HR representative followed by one with someone presenting as the head of a fictitious company — put malware on a work machine, where it replaced a legitimate developer tool component and let attackers run commands and reach an external server.
By October 20, the compromised machine plus an internal AI tool gave attackers a path to two wallet engineers, one of whom held a container deployment token. Crypto Briefing reported that the attackers then deployed a container and ran a script that reached the signing service.
The EIP-7702 step mattered because Ethereum permissions survive policy changes on the exchange side. Suspending withdrawals could not cancel authorizations already written on-chain, and multiparty computation wallets, which have no single private key for immediate revocation, required a specialized procedure. Binance cleared the delegation shortly after midnight UTC on October 30.
Two versions of the last transfer
The outlets differ on the final transfer’s size and timing. Crypto Briefing put it at 2,961.9 ETH, finalized at 23:56 UTC on October 29, with the delegation revoked shortly after midnight on October 30. crypto.news said the same 2,961.9 ETH transfer finalized at 23:56 UTC but reported that Binance cleared the Binance 14 delegation at 00:10 UTC on October 30. Bitcoin.com News described the transfer as approximately 2,962 ETH.
crypto.news also quoted Binance co-CEO Richard Teng saying withdrawals had broadly resumed and that users would bear no losses. The exchange has committed to absorbing the cost itself, rebuilt the affected wallet environment and internal AI tool, replaced employee devices and revoked exposed credentials. CoinShares head of research James Butterfill told crypto.news that custody rules under MiCA give clients of authorized entities stronger safeguards, while noting that authorization cannot prevent every breach.
Why it matters
The report shifts attention from smart contract bugs to people and tooling: a recruitment process, an installer, an internal AI assistant. Exchanges that let engineers run AI agents with deployment rights now face a social-engineering surface their endpoint software did not catch. The theft also tests whether on-chain authorizations granted during an incident can be undone quickly enough when key material is split across an MPC setup.
What to watch
Binance said its investigation is ongoing and that some technical findings will undergo independent verification before further disclosure. It has commissioned an independent cybersecurity review and is weighing a security research fund aimed at AI-related threats. Investigators are still tracing funds, which Elliptic followed through roughly 12,000 wallets on 11 blockchains in under four days.
Reported by Bitcoin.com News.
Sources: Bitcoin.com News, Crypto Briefing, crypto.news