Binance has published its first detailed report on the 29 October hack, saying the attack began months earlier and included a fake job interview that tricked one of its engineers into installing malware.
The exchange said about $6.34 billion in digital assets were affected. “This should not have happened,” Binance said, apologising for the “concern, disruption and uncertainty” it caused users, partners and the wider industry.
Binance said it will cover the losses itself, not its users. It has set aside more than 100% of the funds needed, and as of 31 October had replenished 98% of the affected tokens, which can be checked on its proof of reserves page. It is still buying the remaining, less liquid assets.
About $2.85 billion of the stolen funds has been frozen or intercepted, Binance said, subject to reconciliation and price swings.
Binance cited the FBI’s finding that North Korea was responsible.
How the attackers got in
Binance described a multi-stage campaign rather than a single breach. In June, a wallet engineer downloaded a tampered installer while trying to set up a popular coding tool he had found through a search engine. Binance’s security team spotted the problem, replaced the device and reset his credentials, but the engineer and his colleagues on the wallet team had already been exposed to the attackers.
In September, a second engineer was approached through a legitimate job-hunting website by someone posing as a project director. After a video interview with a fake HR representative, who shared a social media account with personal photos and videos to build trust, he was asked in a second interview to download a coding “assignment” onto his work computer.
The assignment contained hidden malware that ran during setup and swapped a genuine development tool for a malicious copy. Binance said the malware was previously unknown and was not caught by its security software at the time.
On 20 October, the attackers used that compromised computer and an internal AI tool to gain control over two more engineers. One of them had a permission token on his computer that allowed him to deploy software to Binance’s systems.
The attack itself
On 29 October, between 17:15 and 19:56 UTC, the attackers logged on to a third engineer’s computer, used the stolen token to deploy their own software and launched the attack. They used unauthorised access to an internal wallet signing service to send transactions outside Binance’s normal withdrawal process.
Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an address controlled by the attackers. Hot wallets on Solana and Optimism then sent about 970,500 SOL and 44.2 million OP, and another sent 18,270 BTC.
The attackers also used an Ethereum feature called EIP-7702, which lets a wallet hand some control to a smart contract, to give their own contract partial control over a Binance hot wallet.
Why it took hours to stop
Binance suspended withdrawals and worked with partners to freeze tokens, but said that alone could not stop the losses. The attackers’ EIP-7702 permissions sat on the blockchain itself, outside Binance’s withdrawal systems, so they kept working after withdrawals were halted.
Because the wallet used multi-party computation, a security set-up with no single private key, Binance had to build a special procedure to cancel the permissions, which took extra time. The last unauthorised transfer, of 2,961.9 ETH, was completed at 23:56 UTC. Binance cleared the permissions at 00:10 UTC on 30 October, and said no further unauthorised transfers were seen after that.
What Binance has changed
As of 3 November, Binance said it had rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced affected devices and cancelled the credentials linked to the engineers involved. It has also scanned all employee devices, tightened controls on its wallet services and expanded its systems for spotting unusual behaviour.
Binance said it detected and blocked 57 suspected North Korea-linked attacks this year, using methods such as fake job interviews, malware disguised as developer tools and fake video call apps.
What happens next
Binance called this an initial report and said the investigation is ongoing. It is bringing in independent cybersecurity firms to review the incident and check its findings, and plans a security research fund focused on AI security in blockchain systems. Some technical details will stay private to avoid helping future attackers.
