Binance’s preliminary investigation traced the Oct. 29 incident, which affected about $6.34 billion in digital assets, through compromised engineers’ computers and an internal AI tool.
In June, Binance detected an anomaly after a wallet engineer downloaded a tampered installer for an AI coding tool. It replaced the computer and rotated related credentials. In September, a fake job interview led another engineer to download malicious code onto a work computer. Attackers used that computer and an internal AI tool to reach two more engineers on Oct. 20.
On Oct. 29, the attackers used stolen credentials to deploy a container and gain unauthorized access to Binance’s wallet-signing service. They used Ethereum’s EIP-7702 authorization mechanism to give an attacker-controlled smart contract limited execution rights over a hot wallet. Suspending withdrawals did not revoke those on-chain permissions, which required separate transactions to remove.
The incident affected about $6.34 billion in digital assets. About $2.85 billion had been frozen or intercepted as of Nov. 3, a figure subject to reconciliation and price changes. Binance had replenished 98% of affected token assets by Oct. 31 and set aside more than enough funds to cover the losses. It was still acquiring the remaining, less-liquid tokens. Binance has not provided a final net-loss total; frozen assets and replenished assets are separate measures.
The FBI has attributed the attack to North Korea. Binance has rebuilt affected systems, removed compromised credentials and is engaging independent cybersecurity experts to review its preliminary findings.
Simon Yoon
Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to [email protected].
