A fraudulent recruitment exercise helped attackers reach Binance’s wallet signing systems in a campaign that culminated in a $6.34 billion theft, the exchange said in its November 3 initial incident report, covered by SecurityWeek. Three engineers’ computers were compromised over several months, with an internal AI tool involved in the attackers’ expansion through the company’s systems.
Customers have since regained broad access to withdrawals, co-CEO Richard Teng said on November 3, after Binance started restoring them in stages on November 1. Teng also said 98% of the impacted tokens had been replenished. About $2.85 billion in stolen assets has been frozen or intercepted.
Binance’s account describes successive compromises involving software downloads, impersonated recruiters and stolen deployment credentials. The attackers ultimately obtained access that let them authorize transfers, including through blockchain permissions that remained effective after the exchange suspended withdrawals.
A recruitment exercise becomes an entry point
The earliest stage Binance identified occurred in June. An engineer responsible for wallet development and operations searched online for a popular AI coding tool and downloaded a modified Homebrew installation, a software installation tool.
Binance detected that compromise and issued a replacement computer while resetting the associated credentials. By then, however, the intruders had learned about the engineer’s work and relationships within the wallet infrastructure team.
A second engineer became a target in September. Someone presenting themselves as a project director arranged two interviews for a job at a company that did not exist. The first interviewer posed as a human resources representative and used a social media profile featuring personal photographs and videos to establish trust.
The next interviewer claimed to be the company’s CEO. That conversation, conducted through a chat application, led to a request that the engineer download a coding assignment onto his work machine.
Setting up the assignment triggered malicious code contained in its repository—the collection of files for the purported project. The payload replaced a legitimate developer tool component with an attacker-supplied version and established communication with the attackers’ server. Binance called it “0-day malware” and said the computer’s security software failed to detect it at the time.
On October 20, the intruders used that compromised machine together with an internal AI tool to take over computers belonging to the first engineer and a third wallet engineer, although Binance did not describe the tool’s specific role.
The first engineer’s machine contained an authorization token for deploying containers, which package software for execution. On October 29, the attackers accessed the third engineer’s computer and used credentials stolen from the first to launch a container and run a malicious script.
Blockchain permissions outlasted the withdrawal halt
Binance attributed the movement of XRP, SOL, OP and BTC from its hot wallets—wallets used for online transactions—to unauthorized access to an internal service that signs wallet operations.
That service also enabled abuse of Ethereum’s EIP-7702 mechanism. The attackers granted a contract they controlled partial authority to execute actions through a hot wallet. Because those authorizations were recorded on the blockchain, they continued to operate independently of Binance’s withdrawal systems. Halting customer withdrawals therefore could not stop every unauthorized movement of assets.
The affected wallet relied on multi-party computation, or MPC, which shares cryptographic operations among multiple parties. Binance said this meant it lacked a single key with which to revoke the delegated authority immediately. The final unauthorized transfer settled at 23:56 UTC; the delegation was removed shortly after midnight.
The exchange apologized to users, partners and the wider industry for the disruption and uncertainty. It also said it had blocked 57 suspected North Korea-linked threats this year.
The FBI blamed the theft on TraderTraitor, a North Korean state-sponsored hacking group. North Korea rejected the accusation: in a statement carried by state media, Kim Yo Jong, sister of leader Kim Jong Un, characterized it as a political provocation and accused the United States of wrongly assigning cybercrimes to the country.
Recovery and reserves verification
Elliptic said the stolen assets traversed approximately 12,000 wallets across 11 blockchains in less than four days. Its analysis found automation, but no indication that AI agents were deciding how to launder the funds. Approximately $3.18 billion remained in addresses linked to the theft as of November 3.
Chainalysis separately reported that a temporary emergency shutdown at THORChain, caused by an unrelated technical problem, had slowed the laundering.
Binance said it has reconstructed the affected wallet system and internal AI tool, replaced computers and retired the engineers’ credentials and tokens. Independent security firms are being engaged to examine the incident, and the exchange is developing a research fund for AI security in blockchain environments.
For customers checking asset backing, Binance has completed a zero-knowledge proof—a cryptographic verification—for its October 31 reserves snapshot. Holders of 10 major tokens can use it to verify that their balances are backed at least 1:1.
