Cryptocurrency exchange Binance revealed on Tuesday that a sophisticated multi-month cyberattack led to the theft of $6.34 billion from its hot wallet systems on October 29. According to an official incident report, attackers utilized a combination of social engineering, deceptive recruitment tactics, undetected malware, and a compromised internal artificial intelligence tool to breach the platform’s signing infrastructure. Despite the massive breach, Binance announced it had replenished 98% of the affected token assets by October 31, ensuring customer funds remain fully covered and withdrawals have broadly resumed without user losses.
The intrusion originated in June when a DevOps engineer unknowingly exposed wallet infrastructure details after downloading a tampered setup file. Exploiting this breach, the attackers launched a targeted social engineering campaign in September. Posing as hiring managers on a professional network, the hackers conducted fake job interviews with a second engineer and instructed the employee to download an assignment repository containing undetected malware. Once executed, the malicious code silently compromised the work computer, allowing the perpetrators to leverage an internal AI tool on October 20 to hijack two wallet engineers’ workstations and acquire key container deployment credentials.
On October 29, the perpetrators deployed a malicious script to access wallet signing operations, orchestrating rapid transfers of Bitcoin, Solana, XRP, and Optimism. The attackers also manipulated Ethereum’s EIP-7702 delegation mechanism to grant execution permissions to external smart contracts. This allowed unauthorized transfers to continue even after Binance halted standard withdrawal services. Because multiparty computation wallets lack a single private key, technical teams required specialized procedures to revoke the delegations, which were finalized early on October 30.
The Federal Bureau of Investigation has attributed the attack to the North Korean state-sponsored threat group TraderTraitor, working alongside federal law enforcement to trace and block stolen assets across international networks. Binance confirmed that approximately $2.85 billion in stolen funds has already been frozen or intercepted through industry coordination with entities like Tether and Circle. In response, the exchange has completely rebuilt its wallet environment, decommissioned compromised credentials, and commissioned independent cybersecurity audits to fortify its security infrastructure moving forward.
