Binance says its Oct. 29 security incident was a multi-stage campaign that included social engineering: a fake recruiter, two staged interviews and a malicious "assignment" for an engineer. Its initial findings report, published Nov. 3, puts the impacted assets at about $6.34 billion, of which about $2.85 billion was frozen or intercepted.
How the attack unfolded
Binance calls it a multi-stage campaign, "not a single isolated breach or a simple phishing incident." Its timeline:
- June: an engineer on the wallet team downloaded a tampered Homebrew installer while looking for an AI coding tool. Binance says it replaced the device and rotated credentials, but the engineer's team was exposed.
- September: a second engineer was contacted on a job-hunting platform by someone posing as a Project Director. A fake HR interview and a second interview with a supposed CEO followed.
- The assignment: near the end of the second interview, he was told to download an "assignment" onto his work computer. Binance says the repository's malicious code ran during setup, and endpoint protection did not detect the 0-day malware.
- Oct. 20: the attacker used that computer and an internal AI tool to gain control over two more wallet engineers, and found a container deployment token.
- Oct. 29: between 17:15 and 19:56 the attacker used that token on a third engineer's computer to deploy a container and run a malicious script.
What the attacker did
Binance says the attacker used unauthorized access to an internal wallet signing service to start transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism also sent about 970,500 SOL and 44.2 million OP, and one sent 18,270 BTC.
The attacker then used Ethereum's EIP-7702 authorization mechanism to give an attacker-controlled smart contract partial execution rights over a hot wallet. Binance says the wallet's multi-party computation setup meant no single key could revoke those authorizations, so it built a special procedure. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC.
Attribution and response
Binance says the latest FBI information indicates North Korea is responsible. It says its security team detected and prevented 57 suspected North Korea-linked cases during 2026.
It says it closed the entry points, rebuilt the affected wallet system and internal AI tool, replaced devices and decommissioned related credentials. Binance calls this an initial report; the investigation is ongoing and independent firms will review it. Some technical details will stay confidential.
What this means for you
Binance says it will absorb the financial impact of the stolen funds, not its users. It says that as of Oct. 31, 98% of the impacted token assets had been replenished, verifiable on its Proof of Reserves page, and that it is buying the rest.
Binance lists the lures it saw in these campaigns: fraudulent job interviews, malicious software disguised as developer tools, compromised packages and browser extensions, and fake video-conferencing apps. Those are the patterns Binance says it saw. The post gives no instructions for users.
Why it matters
Binance says the 0-day malware went undetected by endpoint protection, and the attacker then moved through an internal AI tool and stolen credentials. Binance also says the supply-chain download in June was caught, yet that engineer's team was still exposed to the attacker.
Related
For another recent credential-exposure story, see Railway env vars may be exposed: rotate every key now. For an AI-security story, see AI agents broke into 100+ sites for about $50 each, researchers say.
