Binance traces $6.34bn crypto heist to months-long intrusion

Binance says attackers spent months compromising employee devices and internal systems before using its wallet signing service to move about $6.34 billion in digital assets on Oct. 29, a timeline that shifts attention from a single breach to the controls that failed across the attack. The exchange’s initial findings and response update, published Nov. 3, says the campaign involved social engineering, malicious downloads, access to internal AI tooling and an on-chain authorization technique. Binance says it will absorb the financial impact; its account of events remains preliminary and subject to independent review.

The scale is exceptional, but the sequence matters as much as the total. Binance says attackers entered through employee systems over several months, then used credentials and deployment access to reach wallet operations. The breach therefore tested both workplace security and the exchange’s ability to revoke transaction permissions once assets were moving.

How did the attackers get from an employee device to the wallets?

Binance’s account starts in June, when a Wallet DevOps engineer downloaded a tampered installation while seeking an AI coding tool. The exchange says its security team detected the anomaly, replaced the device and rotated credentials, but the employee’s role and colleagues on the wallet infrastructure team had been exposed.

In September, a different software engineer was approached through a job-hunting platform by someone posing as a recruiter. Binance says a later interview involved a malicious code repository presented as an assignment. The malware replaced a legitimate development-tool component, evaded endpoint detection and concealed traces of the compromise. On Oct. 20, the attacker used the compromised device and an internal AI tool to gain control of two other engineers’ devices, according to the company.

Binance says that on Oct. 29, credentials stolen from the Wallet DevOps engineer were used on a third engineer’s computer to deploy a container and run a script. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address; Binance also reports transfers of about 970,500 SOL and 44.2 million OP, followed by 18,270 BTC. The company says attackers then used Ethereum’s EIP-7702 authorization mechanism to give a malicious smart contract partial execution rights over a hot wallet.

Why did suspending withdrawals not stop the transfers?

The exchange says the unauthorized signing access let the attackers initiate transactions outside its normal withdrawal process. Once the EIP-7702 authorizations were established on-chain, Binance says they operated independently of its normal withdrawal infrastructure, so suspending withdrawals could not by itself revoke them.

That distinction shaped the response. Binance says it needed additional transactions to clear the authorizations, and its multi-party computation wallet setup meant there was no single private key that could immediately do so. The final unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC; Binance says it cleared the delegation code at 00:10 on Oct. 30. The case shows the trade-off in a system where signing controls are distributed: they avoid reliance on one private key, but revocation can require a more involved procedure.

The Record from Recorded Future News reports that Binance said it had caught and stopped 57 suspected North Korea-linked attempts during 2026. The FBI attributed this incident to North Korea, according to Binance’s update; the exchange does not present its own investigation as finished. A pattern of thwarted attempts makes the successful intrusion a measure of attacker persistence, not proof that the earlier defenses were useless.

What should users and investigators watch next?

Binance says about $2.85 billion in affected assets had been frozen or intercepted as of its update, subject to reconciliation and market-price changes. It also says 98% of impacted token assets had been replenished by Oct. 31, with purchases planned for the remaining, less liquid assets. These are company figures, and the exchange says independent cybersecurity firms will review its findings.

The next evidence will be whether that review validates the access path and the timing of containment, and whether Binance can reconcile replenished assets with funds frozen across networks. The FBI’s attribution, which Binance cites, is a separate investigative claim from the exchange’s reconstruction of how the breach happened. For users, the practical signals are the independent review’s conclusions, the status of the remaining assets and whether changes to wallet-service controls shorten the time needed to revoke on-chain permissions in a future incident.

Source material

• initial findings and response update — binance.bh