Binance has published its first detailed account of how roughly $6.34 billion left its hot wallets on October 29, and the Binance hack report describes a slow, patient intrusion rather than a single slip. The attackers spent about five months working on the exchange’s staff. They started with a tampered developer tool in June and moved on to a fake job interview in September. In the final stage they used an internal AI tool to jump between engineers’ machines.
The exchange posted the report, titled “29 October Binance Security Incident: Initial Findings and Response Update”, on its X account on Tuesday. Co-CEO Richard Teng and chief security officer Jimmy Su took reporters through it at a media briefing the same day. Binance said about $2.85 billion has been frozen or intercepted and that it had replenished about 98% of the affected tokens with company funds. It added that users will not bear the loss.
Three engineers, five months
According to the report, a Wallet DevOps engineer downloaded a tampered Homebrew package in June while trying to install a popular AI coding tool. Binance’s security team spotted the anomaly, replaced the device and rotated his credentials. The damage had already been done in another way, though. The attackers now knew who he was, what he did and who he worked with on the wallet team.
The second engineer was approached in September through a legitimate job platform by someone posing as a project director, Su told reporters, according to CoinDesk. A fake HR representative interviewed him by video. A second interview followed with a purported CEO, and it ended with a request to download a coding assignment onto his work computer. That assignment carried zero-day malware that the company’s endpoint security did not catch.
On October 20 the attackers used that machine, together with an internal AI tool, to take control of the devices of two wallet engineers. One of them held a container deployment permission. On October 29 they logged in with stolen credentials, deployed a container and ran the script that reached Binance’s wallet signing service. “This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance wrote, as quoted by Reuters.
Why pausing withdrawals did not stop the drain
The most useful part of the report for other exchanges explains why the outflows ran for hours after Binance froze withdrawals. Funds began leaving at 20:05 UTC. The attackers had used the signing service to approve an EIP-7702 delegation, the Ethereum feature that lets an ordinary account hand execution rights to a smart contract. That delegation lived on-chain and did not depend on Binance’s withdrawal systems at all. Switching off withdrawals therefore did not stop the malicious contract, which kept moving assets.
Binance’s hot wallets use multiparty computation, so no single key existed that could revoke the delegation quickly. The team had to build a custom procedure to do it. Containment did not finish until 00:10 UTC on October 30, roughly four hours after the first transfer. That detail matters well beyond Binance. MPC setups are popular precisely because they remove single points of failure, and here that same design slowed down the emergency fix.
The chain of events also lines up with what the FBI published last week, when it blamed North Korea’s TraderTraitor group and listed hundreds of linked addresses. Recruitment lures and poisoned coding tests have been that group’s signature for years. Pyongyang has rejected the attribution.
57 attempts this year, one that worked
Binance said its security team detected and blocked 57 suspected North Korea-linked attacks in 2026. They used the same playbook of fake interviews, malware posing as developer tools, tampered packages and browser extensions, fake video call software and social engineering. The breach that succeeded did not need a new trick. It needed one engineer looking for a job and another looking for an AI tool.
The internal AI tool is the element that will worry security teams most. The report does not say exactly how it was abused, and Binance said it is keeping some technical details private while the investigation continues. Still, it confirms that an assistant with broad internal access became a route for lateral movement between employees. The Block reported that Binance has since rebuilt the affected systems, tightened device controls and expanded AI-based behavioural anomaly detection.
What to watch next
This is an initial report. Binance said it is commissioning an independent review by outside cybersecurity experts, and the next step to watch is whether that review is published in full. The gap between the $6.34 billion taken and the $2.85 billion frozen also leaves more than $3 billion in the attackers’ hands. How much of that can still be traced and frozen is an open question.
The exchange also said it will set up a security research fund and work with AI companies on security for blockchain environments. Other exchanges running MPC hot wallets on EVM chains now have a specific question to answer: how fast could they revoke an EIP-7702 delegation they never meant to sign?
FAQ
How did the Binance hack start?
Binance said it began in June with a tampered Homebrew package that exposed a wallet engineer. In September a second engineer installed malware hidden in a fake job interview’s coding test.
Why did funds keep moving after withdrawals were paused?
The attackers had set up an on-chain EIP-7702 delegation that worked outside Binance’s withdrawal systems. Because the hot wallets use MPC, revoking it took until 00:10 UTC on October 30.
Will Binance users lose money?
Binance said the company will absorb the loss. It reported that about 98% of affected tokens have been replenished and about $2.85 billion has been frozen.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
