Binance said on Nov. 3 that a months-long campaign against its staff, including a fake job interview and a compromised internal AI coding tool, paved the way for a breach that cost the exchange $6.34 billion, according to an incident report the exchange posted on X.
The exchange has replenished 98% of the stolen funds and intercepted or frozen $2.85 billion of the stolen assets. Withdrawals across multiple blockchains began reopening on Nov. 3.
In June, a wallet engineer installed a tampered update through the Homebrew package manager while setting up an AI coding tool on his computer. In September, a second employee was pulled into a sham hiring process, interviewed by impostors posing as an HR representative and the company's CEO.
He was handed a coding assignment that hid malware. On Oct. 20, the attackers used the compromised machine and the internal AI tool to reach two more wallet engineers' systems.
On Oct. 29, the attackers deployed a malicious script and took advantage of a little-known Ethereum mechanism, EIP-7702, that hands over transaction execution rights, to seize control of Binance's hot wallet. Funds began leaving the wallet at 20:05 UTC, and Binance contained the breach by 00:10 UTC on Oct. 30.
The FBI linked the attack to North Korea. Binance said it had detected and blocked 57 attempts this year that it attributes to hackers tied to North Korea.
Co-CEO Richard Teng said: “We're publishing the full report because the lessons go far beyond Binance.” Co-founder Yi He added: “We intercepted many of them, but the cost of failing to stop even one was severe.”
The report doesn't say how Binance plans to recover the roughly 2% of stolen assets still unaccounted for.
