Binance has revealed how attackers spent several months compromising employee devices and internal systems before stealing approximately $6.34 billion in digital assets during the October 29 security incident. The Binance hack report, published on November 3, details a multi-stage operation involving malicious developer software, fake recruitment interviews, compromised credentials, and unauthorized access to wallet-signing infrastructure.
The exchange said the attackers gained unauthorized access to an internal wallet signing service, allowing them to initiate transactions outside its normal withdrawal process. Binance confirmed that approximately $2.85 billion in digital assets had been frozen or intercepted. It also said 98% of the affected token assets had been replenished as of October 31.
Fake Recruitment Interviews Helped Attackers Access Internal Systems
Binance’s investigation found that the operation began months before the funds were stolen. In June 2026, a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Although Binance detected suspicious activity, replaced the device, and rotated related credentials, the attackers had already learned about the employee’s role and colleagues working on wallet infrastructure.
The attackers later targeted another software engineer through a fake recruitment process in September. They posed as representatives of a fictitious company and convinced the employee to download a coding assignment onto a work computer. The repository contained malicious code that replaced a legitimate component of the pyenv development tool, allowing the attackers to execute commands and communicate with an external server.
By October 20, the attackers had used a compromised device and an internal Binance AI tool to reach the systems of two additional employees. They also discovered a token that provided container deployment permissions. On October 29, stolen credentials and access to the compromised systems allowed them to deploy a malicious container and execute a script targeting the exchange’s wallet signing operations.
Binance Details the Attack in Its Official Update
Binance shared an update about its investigation through its official X account. The announcement provides additional context about the incident and the exchange’s response.
https://t.co/sU9dUqLQDH
— Binance (@binance) November 3, 2026
EIP-7702 Authorizations Complicated the Response
The attackers used Ethereum’s EIP-7702 authorization mechanism to grant an attacker-controlled smart contract execution permissions over a Binance hot wallet. This allowed them to move assets without following the exchange’s standard withdrawal process.
Binance said the attackers submitted 50 signing transactions with different account nonce values to establish malicious delegations. Once the authorization became active on-chain, suspending normal withdrawals was not enough to stop every unauthorized transfer.
The exchange also faced additional challenges because its hot wallets used multi-party computation (MPC). This architecture distributes signing authority rather than relying on one private key. Binance therefore had to develop a separate procedure to revoke the unauthorized permissions. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC on October 29. At 00:10 UTC on October 30, Binance executed a new authorization to clear the malicious delegation.
Binance Rebuilds Affected Systems and Expands Security Controls
Binance said the FBI had attributed the attack to North Korea. The agency identified the activity as part of the TraderTraitor operation, which has been associated with cryptocurrency theft and attempts to launder stolen digital assets.
Following the incident, Binance rebuilt the affected wallet environment and internal AI tool, replaced compromised devices, and revoked related employee credentials and access tokens. The exchange also completed additional security scans across employee devices and strengthened wallet-service controls and AI-based behavioral anomaly detection.
Binance said it would absorb the financial impact of the stolen funds rather than pass the losses on to customers. The exchange is also bringing in independent cybersecurity firms to review its findings and plans to expand investment in AI security and research initiatives. Withdrawal services are being restored in phases as security checks are completed across supported networks and assets.
For additional context on cryptocurrency theft investigations, read our coverage of how operational security mistakes helped investigators trace a suspected $90 million crypto theft.
.jpg "Incident Response Preparation")
No Comment! Be the first one.