Binance's Hack Report: a Fake Job Interview, a Tampered Homebrew Install and an Internal AI Tool Led to the $6.34 Billion Theft

Binance has published its first account of how attackers took about $6.34 billion from its hot wallets on 29 October. The report, posted on 3 November, describes a campaign that ran for months: a tampered Homebrew install in June, a fake job interview in September, an internal AI tool used to reach other staff on 20 October, and finally the wallet signing service. Binance cites the FBI's finding that North Korea is responsible.

About $2.85 billion has been frozen or intercepted, Binance says, and it will absorb the loss so users don't.

How the attackers got in

In June an engineer on the wallet DevOps team searched for a popular AI coding tool and downloaded a tampered Homebrew installation to install it. Binance's security team spotted it, replaced the device and rotated the credentials, but the report says the engineer's role and colleagues on the wallet team were exposed to the attacker.

In September a second engineer, whose profile on a job platform mentioned Binance, was approached by a fake "Project Director". After a video interview with a fake HR representative, a second round on a chat app ended with an instruction to download an "assignment" to his work computer. Its setup script swapped the machine's pyenv for a malicious copy, and the report says this "0-day malware was not detected" by endpoint protection at the time.

On 20 October the attacker used that computer and an internal AI tool to take control of the accounts of the first engineer and a third. One of them held a container deployment token. On 29 October, between 17:15 and 19:56 UTC, the attacker logged on as the third engineer, deployed a container and triggered a malicious script.

Why withdrawals couldn't stop it

Through the signing service, the attacker sent 233.46 million XRP, about 970,500 SOL, 44.2 million OP and 18,270 BTC to its own addresses. It then abused Ethereum's EIP-7702, which lets an account delegate execution rights to a smart contract, and submitted 50 signing transactions to give its own contract partial control of a hot wallet.

Those authorisations sat on-chain, so pausing withdrawals didn't cancel them, and because the hot wallet used multi-party computation there was no single private key that could revoke them at once. Binance had to build a special procedure. The last unauthorised transfer, 2,961.9 ETH, finalised at 23:56 UTC, and Binance cleared the delegation at 00:10 UTC on 30 October.

Where the money is

Elliptic counts about 12,000 wallets across 11 blockchains used to move the funds in three and a half days. It says around $3.18 billion still sits in linked addresses and that the laundered part may already be with Chinese money laundering networks. TRM Labs describes a new trick: a token on TRON that only its creator can mint, used to move value between wallets with no direct transfer between them.

Binance says it detected 57 suspected North Korea-linked cases this year, using fake interviews, fake developer tools and compromised packages. Since the attack it has rebuilt the wallet system and the internal AI tool and replaced affected devices.