The massive $6.34 billion security breach at Binance started with a bogus employment interview and persisted over a five-month span prior to any digital currency being transferred, the trading platform revealed on Tuesday during its initial public disclosure regarding the October 29 security incident.
An initial incident report published by Binance, alongside a press conference hosted by co-CEO Richard Teng and chief security officer Jimmy Su, outlined an operation that merged a compromised software package, a fake hiring procedure, evasion malware capable of bypassing endpoint protection, and a proprietary corporate AI utility that the perpetrators weaponized against the platform’s own wallet engineers.
Binance stated that it has successfully frozen or intercepted roughly $2.85 billion worth of the pilfered funds and reimbursed 98% of the impacted tokens using its corporate reserves, with the remainder acquired through open market purchases.
“This wasn’t one mistake or one breach — it was a months-long campaign,” Teng posted on X. “We’re publishing the full report because the lessons go far beyond Binance.”
The FBI has attributed the cyberattack to North Korea. The Binance disclosure references this conclusion while stopping short of making its own official attribution. Pyongyang refuted the accusation on Monday, with Kim Yo Jong, the sister of supreme leader Kim Jong Un, labeling it a “grave political provocation” via state media channels.
The Binance hack had five months of preparation
As explained by Binance, the initial point of entry for this intrusion occurred in June, when a wallet DevOps employee searched for a well-known AI development utility and inadvertently downloaded a modified Homebrew installation package.
The security division at Binance detected the irregularity, swapped out the hardware device, and reset credentials, but the event exposed the staff member’s position and the identities of peers within the wallet architecture division.
During September, a second engineer received outreach on a legitimate professional networking platform from an individual pretending to be a project lead. A video interview featuring a purported human resources representative followed, during which the interviewer utilized a personal social media profile to establish trust. A subsequent conversation with a supposed chief executive concluded with a “task”: a code repository the worker was instructed to deploy on their office workstation.
This repository swapped out an authentic pyenv component for a malicious variant while establishing a connection to an attacker-operated server. Binance reported that this zero-day malware escaped detection by its endpoint security software at that time.
On October 20, the threat actors leveraged that compromised workstation alongside an internal artificial intelligence utility to target two additional wallet staff members, one of whom possessed a container rollout token. On October 29, between 17:15 and 19:56 UTC, the perpetrators accessed a third engineer’s computer, deployed a container utilizing the acquired credentials, and initiated the asset drainage. Binance mentioned it has blocked 57 separate suspected North Korea-associated incursions throughout the year employing comparable social engineering tactics.
Four hours to contain
The funds were drained rapidly. Between 20:05 and 20:09 UTC, five hot wallets transferred 233.46 million XRP to an address controlled by the attackers. Solana and Optimism-based wallets followed suit, moving roughly 970,500 SOL and 44.2 million OP. Subsequently, a Binance hot wallet transferred 18,270 BTC.
The adversary exploited the compromised signing mechanism to trigger Ethereum’s EIP-7702 standard, which permits an account to assign execution authority to a smart contract without exposing its private key, thereby granting a malicious contract partial control over a Binance hot wallet.
Halting platform withdrawals failed to close that final pathway. The malicious actors had executed 50 signing operations to establish on-chain delegations functioning independently of Binance’s withdrawal architecture. Because the wallet relied on multi-party computation, no solitary key existed to cancel them, requiring the security crew to devise an ad-hoc remedy. The final unauthorized movement totaling 2,961.9 ETH was completed at 23:56 UTC.
Binance successfully eliminated the delegation at 00:10 UTC on October 30.
The documentation acknowledges this operational blind spot. “These challenges extended the time required to fully contain the unauthorized asset movements,” the document notes, adding that the enterprise is currently evaluating its signing policy protocols and hot wallet safety measures.
Platform users withdrew $10.97 billion during the 46-hour window following the restoration of withdrawals on Sunday, resulting in net outflows of $5.28 billion, according to metrics shared by Teng on Tuesday. By 03:00 UTC, hourly deposits surpassed redemptions, a shift Teng described as an indicator of stabilization. Binance re-enabled withdrawals for numerous additional digital assets across nine distinct networks on Tuesday.
The security breach has transformed into a major discussion topic within Washington. CFTC Chairman Michael Selig stated that the exploit “proves our exact point” concerning the necessity of a federal registration pathway for offshore trading platforms, and on Tuesday the regulatory body authorized equity perpetual futures for platforms regulated within the U.S., expanding the domestic integration initiative initiated via Kalshi’s bitcoin perp debut in May.
Binance reported that it has reconstructed the wallet architecture and the proprietary AI utility within isolated environments, swapped out compromised hardware, revoked employee access credentials, and broadened behavioral anomaly tracking.
The exchange is enlisting an independent auditing firm, boosting expenditures dedicated to endpoint and developer environment protections, and organizing an academic fund focused on AI security alongside external partners. Certain technical specifics, according to the report, will remain confidential.
Originally published at https://bitcoinmagazine.com/news/binance-says-6-34-billion-hack-job.
