By Binance has disclosed that the $6.34 billion cryptocurrency theft on October 29 resulted from a months-long campaign involving fraudulent job interviews, malicious developer software and the compromise of an internal artificial intelligence tool. The attackers ultimately gained access to the exchange’s wallet-signing infrastructure, allowing them to authorize transactions outside its normal withdrawal process.
In an initial incident report published November 3, Binance detailed how the attackers compromised multiple employees’ computers, obtained deployment credentials and exploited Ethereum’s EIP-7702 authorization mechanism to maintain control over assets even after withdrawals were suspended.
The exchange said approximately $2.85 billion in assets had been frozen or intercepted, while 98% of affected token assets had been replenished as of October 31. Binance has pledged to absorb the losses through company resources rather than passing them on to customers.
How Did a Fake Job Interview Lead to the Binance Hack?
The attack began in June when a Wallet DevOps engineer downloaded a tampered Homebrew installation while attempting to install an AI coding tool. Binance detected the anomaly, replaced the device and rotated the associated credentials. However, the compromise had already exposed information about the engineer’s responsibilities and colleagues working on wallet infrastructure.
In September, the attackers targeted another software engineer through a legitimate recruitment platform, posing as representatives of a fictitious company. The employee completed a video interview with a supposed human resources representative and later participated in a second interview with someone claiming to be the company’s chief executive.
During the recruitment process, the employee was instructed to download a coding assignment containing malicious software onto his work computer. The malware executed during setup, replaced a legitimate development-tool component and established communication with an attacker-controlled server.
Binance said the previously unknown malware evaded its endpoint security tools and employed techniques designed to conceal the intrusion.
On October 20, the attackers used the compromised computer and an internal AI tool to gain control of two other engineers’ devices. They subsequently discovered a credential carrying container deployment permissions.
On October 29, between 17:15 and 19:56 UTC, the attackers accessed another engineer’s computer, used the stolen deployment credentials and executed a malicious script that launched the wallet attack.
Investor Takeaway
The intrusion exposed how compromised developer environments and internal AI tools can provide access to critical financial infrastructure without directly stealing wallet private keys.
Why Did the Theft Continue After Binance Suspended Withdrawals?
Binance said the attackers gained unauthorized access to an internal wallet-signing service, enabling transactions beyond its conventional withdrawal infrastructure.
Between 20:05 and 20:09 UTC on October 29, five hot wallets transferred 233.46 million XRP to an attacker-controlled address. Additional transfers included approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
The attackers subsequently exploited Ethereum’s EIP-7702 mechanism, which allows accounts to delegate certain execution permissions to smart contracts without disclosing their private keys.
Using 50 signing transactions, the attackers manipulated account nonces and established malicious authorizations that allowed an attacker-controlled contract to execute additional transfers.
This complicated Binance’s response because suspending withdrawals and disabling hot wallet services did not automatically revoke permissions already recorded on-chain.
The exchange’s multi-party computation wallet structure also prevented the team from using a single private key to immediately invalidate the authorizations. Binance had to develop a specialized revocation procedure.
The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the malicious EIP-7702 delegation at 00:10 UTC on October 30.
The findings provide a fuller explanation of the wallet-signing questions raised in earlier reporting on the breach, when Binance said it had found no evidence of private-key exposure despite unauthorized transactions being signed.
How Much Has Binance Recovered or Replaced?
Binance said the attack affected approximately $6.34 billion in digital assets, with $2.85 billion frozen or intercepted through cooperation with law enforcement, blockchain intelligence firms and industry partners.
The latest figure differs from the approximately $3 billion previously reported as frozen, with Binance cautioning that the totals remain subject to reconciliation and market-price fluctuations.
The exchange said it had allocated more than enough resources to cover the losses and replenished 98% of affected token assets by October 31. The remaining purchases involve less liquid assets.
The company has also gradually restored withdrawal services following the disruption.
The FBI has attributed the attack to North Korea. Binance separately disclosed that it had detected and prevented 57 suspected North Korea-linked cyber threats throughout 2026, including attempts involving fraudulent interviews and compromised developer tools.
Investor Takeaway
Replenishing customer assets reduces immediate balance-sheet uncertainty for users, but frozen assets are not equivalent to recovered funds, and the effectiveness of the rebuilt infrastructure remains to be independently assessed.
What Security Changes Has Binance Introduced?
Binance said it has rebuilt the affected wallet system in a new environment, reconstructed its compromised internal AI tool,