Binance published on November 3 its first detailed report on the theft of about $6.34 billion from its hot wallets on October 29, the largest cryptocurrency theft on record. According to the exchange, it was not a single click or a leaked private key: it was a months-long campaign combining a tampered installer, a fake job interview and the misuse of an internal artificial intelligence tool.
From a tampered installer to the fake job interview
It began in June, when a DevOps engineer looking for an AI coding tool installed a tampered version of the Homebrew package manager. The security team spotted the problem, replaced the laptop and rotated the credentials involved — but the attackers came back in September through another route.
In September, the attackers ran the fake job interview: someone posing as a project director approached a software engineer on a legitimate job platform. After a video interview with a supposed HR representative and a second round with someone claiming to be the CEO of a company that does not exist, the engineer downloaded a coding “assignment” onto his work computer. Its setup replaced the developer tool pyenv with a malicious copy that called out to an attacker-controlled server.
The internal AI tool and the theft
On October 20, the attackers used an internal Binance AI tool to take control of two more engineers’ computers. On October 29, from a third engineer’s machine and using stolen credentials, they deployed a container and ran a script that reached the internal wallet-signing service. With about 50 signing transactions, they manipulated nonces and used Ethereum’s EIP-7702 mechanism to delegate execution rights to a contract they controlled — without needing the private key, since the wallet used multi-party computation (MPC).
On October 31, the FBI attributed the theft to the TraderTraitor group, linked to North Korea — an attribution Pyongyang denied. Binance said about $2.85 billion had been frozen or intercepted with the help of authorities and partners, and that 98% of the affected assets had been replenished by October 31, with no loss to customers. The company also said it had blocked 57 other suspected North Korean hacking attempts this year.
What the report still does not explain
The report is still preliminary: Binance disclosed no malware family and no file hashes, domains or IP addresses for the endpoint stages, and the full technical post-mortem remains pending, under review by independent firms. The attack-path details should therefore be read as Binance’s own account, partly corroborated by independent analyses from firms such as TRM Labs and Reversing Labs.
Update: this article updates Geekiki’s earlier coverage of the case — Binance diz que fundos estão seguros após ataque de US$ 6,3 bi, Binance diz ter reposto 90% dos ativos e mantém saques para 1º de novembro and Binance reabre saques em fases a partir da rede Bitcoin após roubo de US$ 6,3 bilhões — with the new information from the November 3 report.
Image credit: Binance (BNB) logo, via Wikimedia Commons, from official Binance material.
Sources: FinanceFeeds, Reversing Labs, ten10, CoinDesk. Binance also shared the report on its X account on November 3.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checking public posts on X and sources from the internet. Always consult the original sources cited.
Muse
