Binance Traces $6.34B Hack to Six-Month Cyber Campaign

Binance traced the theft of about $6.34 billion in digital assets on Oct. 29 to a six-month cyber campaign involving compromised software, social engineering and unauthorized blockchain permissions. The exchange’s initial findings report, published Nov. 3, says the incident was not a single phishing attack.

The campaign began in June, when an engineer downloaded a tampered Homebrew installer while setting up an artificial intelligence coding tool found through a search engine. Binance detected unusual activity, replaced the engineer’s device and changed related credentials. The attackers had already learned the engineer’s role and identified colleagues on the wallet infrastructure team.

In September, an attacker contacted another Binance engineer through a legitimate job-hunting platform while posing as a project director. The engineer took part in interviews with people representing a fictitious company. During the second interview, the engineer was told to download a coding assignment to a work computer.

The repository contained code that ran during installation. Binance reported that the malware replaced a legitimate 3,344-byte pyenv binary with a malicious 3,414-byte version. This allowed the attackers to execute commands and connect to a server they controlled. Endpoint protection tools did not detect the malware at the time.

On Oct. 20, the attackers used the compromised computer and an internal AI tool to reach two more engineers. One had a container deployment permission token on the computer, providing access to the wallet signing service.

Between 17:15 and 19:56 UTC on Oct. 29, the attackers logged into the second engineer’s computer, used stolen credentials, deployed a container and ran a malicious script. From 20:05 to 20:09 UTC, five Binance hot wallets sent about 233.46 million XRP to an attacker-controlled address. Other hot wallets sent about 970,500 SOL and 44.2 million OP. A separate wallet transferred 18,270 BTC.

Binance received an internal alert about the transfers and suspended withdrawals while coordinating with other companies to freeze funds. The exchange reported that about $2.85 billion was frozen or intercepted. Transfers continued because the attackers used Ethereum’s EIP-7702 authorization feature, which allows an account to delegate certain execution rights to a smart contract without exposing its private key.

An attacker-controlled contract gained partial execution rights over a Binance hot wallet. The attacker submitted 50 signing transactions to manipulate the account nonce and preserve those authorizations. Binance reported that the permissions operated on-chain and outside its normal withdrawal system. Because the wallet used multi-party computation, there was no single private key that could be revoked to stop the activity.

The final unauthorized transfer, involving 2,961.9 ETH, was completed at 23:56 UTC. Binance cleared the delegation code from its Binance14 hot wallet at 00:10 UTC on Oct. 30.

Binance reported that 98% of the affected assets had been replenished by Oct. 31 and that it had set aside more than the amount needed to cover the loss. The exchange said its figures for frozen or intercepted assets were still being reconciled and could change with market prices.

The exchange has not identified the job-hunting platform, the fictitious company or the internal AI tool. Independent security firms will review the findings, while some technical details will remain confidential to limit the risk of copycat attacks.

Binance attributed the broader activity to suspected North Korea-linked actors and cited a separate FBI attribution of the Oct. 29 incident to North Korea. The 57 prevented cases involved fraudulent job interviews, malicious developer tools, compromised software packages and browser extensions, fake video-conferencing applications, and attempts to steal credentials or install remote-access malware.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” Binance wrote.

Reviewed and fact-checked by Alex Panasenko on November 4.