A multi-stage cyberattack that compromised engineers and manipulated an internal artificial intelligence tool led to the unauthorized movement of billions in digital assets from Binance on Oct. 29, the cryptocurrency exchange said in an incident report.
The breach impacted roughly $6.34 billion in assets across several blockchains before Binance and industry partners froze or intercepted $2.85 billion. Binance said it will absorb the entire loss and has already replenished 98% of the affected assets from company reserves, leaving user balances whole.
The intrusion was carried out over five months by North Korean state-sponsored hackers who targeted specific technical personnel to bypass security controls.
The Attack Path
June 2026
The attack began in June when an initial wallet DevOps engineer downloaded a tampered installer for an AI coding tool from the internet. Binance detected the malicious software, replaced the computer and rotated account credentials. However, the software had already exposed the structure of the wallet team and the identities of key staff to the attackers.
September 2026
In September, the hackers targeted a second worker, a software engineer, through a fake recruitment process on an employment platform. After conducting a live video interview to build trust, the purported employer sent a technical coding assignment. The engineer downloaded and ran the assignment on a work computer, unknowingly installing zero-day malware that gave the attackers remote access to the machine.
October 20, 2026
On Oct. 20, the attackers used that infected computer to reach an internal AI tool. Through that tool, they accessed computers belonging to the first DevOps engineer and a third wallet software engineer. On the first engineer’s computer, the attackers located an administrative token that permitted container deployments.
October 29, 2026 (Afternoon)
On the afternoon of Oct. 29, the intruders logged onto the third engineer’s computer using the stolen deployment credentials. They launched an unauthorized software container that connected directly to Binance’s internal wallet-signing operations.
October 29, 2026 (Evening)
Starting at 8:05 p.m. UTC that evening, the attackers used the signing system to trigger massive unauthorized withdrawals from Binance hot wallets, transferring XRP, Solana, Optimism and Bitcoin to external addresses.
On Ethereum, the attackers also exploited an authorization feature known as EIP-7702. The mechanism allowed them to assign execution rights over a Binance hot wallet to an external smart contract. Because the delegation existed directly on the blockchain, the attackers were able to continue moving funds even after Binance shut down internal wallet systems and halted platform withdrawals.
October 29, 2026 (Midnight)
Binance halted the transfers just after midnight on Oct. 30 by broadcasting an on-chain transaction that revoked the EIP-7702 delegation.
Binance said findings from the Federal Bureau of Investigation linked the operation to cyber units operating for North Korea. The exchange has since replaced all compromised employee hardware, rebuilt the wallet systems and internal AI tools in new environments and decommissioned all affected access credentials.
Disclosure: AI is used to assist in developing this story.
This article is published on BitPinas: Binance Says Fake Job Interview and Malicious Code Download Sparked Security Breach
What else is happening in Crypto Philippines and beyond:
