Summary
- Binance's investigation identifies a multi-stage campaign involving malicious software and social engineering against engineers.
- Attackers reached wallet-signing infrastructure and abused Ethereum's EIP-7702 authorisation mechanism.
- The company reports approximately $2.85bn in frozen or intercepted assets and is commissioning independent review of its findings.
Binance has traced its $6.34 billion cryptocurrency theft through a series of compromises involving developer computers, malicious software, internal AI tooling, and access to services responsible for authorising wallet transactions.
A technical account published on 3 November provides new details about the intrusion leading to the 29 October incident, identifying activity beginning several months before the theft.
According to the exchange, attackers compromised engineering environments and obtained credentials that ultimately allowed unauthorised transactions through internal wallet-signing infrastructure.
The investigation also describes how Ethereum transaction authorisations complicated efforts to contain the attack after Binance detected suspicious asset movements and suspended normal withdrawals.
The company estimates that approximately $6.34 billion in digital assets was affected, with around $2.85 billion subsequently frozen or intercepted. Those financial figures remain subject to reconciliation and market-price changes.
Developer compromises established initial access
Binance’s investigation traces one stage of the campaign to June, when a wallet infrastructure engineer downloaded a modified software installer while attempting to obtain an AI development tool.
The exchange says its security systems detected suspicious activity, prompting the replacement of the affected device and rotation of associated credentials.
However, the wider investigation subsequently identified further compromises involving engineering staff.
In September, another employee was approached through a legitimate recruitment platform by someone impersonating a prospective employer.
The interaction developed into a recruitment process involving a software assignment. When the engineer prepared the supplied project on a work computer, malicious code executed and provided another route into the environment.
According to Binance, the malware used obfuscation and evasion techniques that prevented its endpoint protection tools from identifying the activity at the time.
On 20 October, the attackers used compromised devices and an internal AI tool to reach additional systems associated with wallet development.
Credentials and a container deployment token obtained during the intrusion subsequently enabled activity involving services connected with wallet operations.
The company’s findings describe an attack that crossed several trust boundaries, moving from an individual developer environment into systems with substantially greater financial authority.
Wallet signing became the decisive target
On 29 October, attackers used unauthorised access to an internal wallet-signing service to initiate transactions outside Binance’s ordinary customer withdrawal process.
The exchange reports that five hot wallets transferred approximately 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC.
Additional transfers involving Solana and Optimism followed, alongside transactions affecting other digital assets.
The attack also exploited Ethereum’s EIP-7702 authorisation mechanism.
EIP-7702 allows certain execution capabilities to be delegated to a smart contract without disclosing the underlying private key. In this incident, Binance says the attacker used the compromised signing service to establish malicious delegations associated with a hot wallet.
Once those authorisations existed on the blockchain, suspending customer withdrawals and shutting down ordinary wallet services did not automatically invalidate them.
The attacker could therefore continue attempting asset movements independently of the exchange’s normal withdrawal infrastructure.
Binance also used multi-party computation within its wallet architecture, meaning there was no single private key available to revoke the malicious authorisations immediately.
The company says it developed a specialised procedure to clear the delegations and stop further unauthorised transfers.
The final unauthorised transfer, involving 2,961.9 ETH, was completed at 23:56 UTC on 29 October. Binance reports that a subsequent authorisation transaction cleared the affected delegation code shortly after midnight.
Recovery and wider investigation
Binance says it has rebuilt or replaced systems involved in the attack, tightened device controls, and introduced additional safeguards around wallet services and internal AI tools.
It has also expanded behavioural anomaly detection intended to identify unusual activity across sensitive systems.
The exchange reports that the FBI’s latest information attributes the attack to North Korea. That attribution is presented as a law-enforcement assessment rather than an independently established conclusion from the company’s published technical evidence.
Binance has committed to covering the losses associated with the incident and says it is engaging external security specialists for independent review.
The findings extend the earlier account of the financial impact and the restoration of withdrawals and reserve verification by identifying how the attackers reached transaction-authorisation systems.
They also illustrate the consequences of access obtained through developer tools and recruitment-based social engineering when that access can eventually reach services responsible for financial transactions.
The investigation remains open, including examination of the attack path and the effectiveness of the additional controls introduced since 29 October.
