Binance has published its first detailed account of the October 29 attack that drained about $6.34 billion from its wallets, and it says the latest information from the FBI points to North Korea as the culprit. The exchange describes a patient, multi-stage operation that ran from June through October, started with a tampered software installer and a fake job interview, and ended with attackers using an internal AI tool to move through the company’s wallet team.
The theft is the largest in crypto history.
Users won’t bear the loss
Binance says it will absorb the damage itself. The company claims to have set aside more than 100% of the funds needed to cover the loss, and says 98% of the affected token assets had been replenished as of October 31, which can be checked on its Proof of Reserves page. It is still buying the remaining, less liquid assets.
Of the roughly $6.34 billion impacted, about $2.85 billion has been frozen or intercepted so far, subject to reconciliation and price swings. Binance says it has closed the entry points used in the attack, rebuilt the systems along the attack path, and added tighter device controls, stronger risk checks on its wallet services, and more AI-based behavioural anomaly detection.
How the money moved
According to Binance, the attacker got unauthorised access to an internal wallet signing service, which let it initiate transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC on October 29, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism then sent roughly 970,500 SOL and 44.2 million OP. Binance’s internal alerts flagged the large transfers and it began investigating, but a hot wallet also sent out 18,270 BTC.
The attacker then turned to Ethereum’s EIP-7702 mechanism, which lets an account hand certain execution rights to a smart contract without revealing its private key. Here, it was used to give an attacker-controlled contract partial control over a Binance hot wallet.
That is what made the incident so hard to stop. Binance suspended withdrawals and worked with partners to freeze tokens, but the malicious authorisations lived on-chain and kept working independently of Binance’s withdrawal systems. The attackers had submitted 50 signing transactions to manipulate the account nonce and lock the delegations in. And because the hot wallet used multi-party computation, there was no single private key that could simply revoke them, so the team had to build a custom procedure to do it. The last unauthorised transfer, 2,961.9 ETH, finalised at 23:56 UTC, and Binance cleared the delegation at 00:10 UTC on October 30.
A months-long campaign
Binance stresses this was not a one-off phishing incident. It describes a campaign combining fake recruitment interviews, malicious software downloads, a compromised internal AI tool, endpoint compromise, and the advanced transaction-authorisation trick above. The company says its security team detected and blocked 57 suspected North Korea-linked cases in 2026 alone.
- June: A DevOps engineer on the wallet team searched online for a popular AI coding tool and ended up installing a tampered version of Homebrew. Binance’s security team caught the anomaly, replaced the device and rotated credentials. But the engineer’s role, and that of his colleagues on the wallet infrastructure team, had already been exposed to the hacker.
- September: A software engineer was approached on a legitimate job-hunting platform by someone posing as a project director, who set up two interview rounds. The first was a live video call with a supposed HR representative, who shared a social media account full of personal photos and videos to build trust. The second took place on a chat app with someone claiming to be the CEO of a fictitious company, and ended with the engineer being told to download an “assignment” onto his work computer. The repository contained code that ran during setup, swapped a legitimate development tool component for a malicious one, and connected to an attacker-controlled server. Binance says the previously unseen malware evaded its endpoint protection and the attacker took steps to erase traces.
- October 20: Using that compromised machine, the attacker used an internal AI tool as a springboard to gain control over the original DevOps engineer and another wallet software engineer. It then found a container deployment token on the DevOps engineer’s computer.
- October 29: Between 17:15 and 19:56, the attacker logged into the second engineer’s computer, used the stolen credentials to deploy a container, and triggered the script that launched the attack.
Attribution
Binance says the FBI’s most recent information indicates North Korea is responsible. Blockchain intelligence firms had pointed the same way earlier: TRM Labs attributed the hack to TraderTraitor, which it described as North Korea’s elite hacking unit, while Chainalysis called it a likely job of the same group. TRM noted that several features matched earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February 2025.
What comes next
Binance says it is bringing in independent security firms to review the incident and validate its findings, and that some technical details will stay confidential so they can’t be used to plan future attacks. It plans to invest more in AI-enabled detection, endpoint protection, developer-environment security and behavioural monitoring, and is working on a security research fund and initiatives with AI companies and security firms focused on AI security in blockchain environments. Binance has also said it is reviewing its own response, including signing policy coverage and hot wallet controls, after the revocation process stretched out the time needed to contain the attack.
The episode adds to a brutal stretch for security. October was dubbed “Black October” by tech executives, and hackers recently forced European supermarket fridges into defrost mode, destroying millions of euros of food. Binance’s account suggests the next frontier may be the AI tools that engineers now use every day, which in this case became the bridge between one infected laptop and the keys to the company’s wallets.