Binance says attackers reached the service that signs its hot-wallet transactions on 29 October after two earlier breaks: a poisoned Homebrew install in June and a fake job interview in September. A hot wallet is an online wallet the exchange keeps funded so it can send coins quickly. Homebrew is a tool Mac developers use to install software.
A doctored Homebrew install in June
In June an engineer on the wallet DevOps team searched for a widely used AI coding assistant and downloaded a Homebrew installer that had already been altered. Security staff noticed, gave him a new computer, and rotated the logins on the old one. The exchange says his role, and the coworkers beside him on the wallet infrastructure team, stayed visible to the intruders.
Interviews on a real job board
A second opening came in September. That engineer had a profile on a genuine hiring site that mentioned his time at Binance. A stranger there, using the title of project director, set up two conversations. The first was a video call with someone playing recruiter, who shared a social account full of personal photos and videos. The second, in a common chat app, was with someone introduced as the head of a company that does not exist.
At the end of that second call he was told to copy a code repository onto the company laptop and treat it as the test. During setup the repository swapped a normal developer tool for a hostile stand-in that could run commands and phone a server the intruders controlled. Binance says its endpoint tools had never seen the program, so they missed it, and that the intruders then tried to wipe the traces.
According to CoinDesk, Richard Teng told reporters the attack “was a campaign, built over many months.”
An internal AI tool on 20 October
On 20 October, Binance says, the intruders moved from the September laptop through an internal AI tool onto two more machines: the June DevOps engineer and a second wallet software engineer. On the DevOps machine they found a token that could deploy containers.
On 29 October they used the second engineer’s computer from 17:15 until 19:56. With the token from the DevOps machine they launched a container and a script against the internal service that signs wallet transactions.
Outflows, then EIP-7702
Binance times the first coins leaving at 20:05 UTC. In the next four minutes, five hot wallets moved 233.46 million XRP to an address the intruders held. Wallets on Solana and Optimism sent roughly 970,500 SOL, along with 44.2 million OP. An internal alarm on the size of those transfers put staff on the case. A bitcoin wallet then moved 18,270 BTC, figures also laid out by CryptoBriefing.
The signing service was next pointed at Ethereum’s EIP-7702. That rule lets an account grant a smart contract limited power to act for it, and the private key stays put. The contract belonged to the intruders, and the grant covered one Binance hot wallet. Fifty signing transactions advanced the account nonce, the counter that orders its transactions, until the hostile delegation was on the chain. Later sends could skip the usual withdrawal path.
Pausing withdrawals and taking the hot-wallet service offline left those on-chain grants in place. Partners were asked to freeze tokens. Clearing the delegation was slow because the hot wallet uses multi-party computation, so nobody holds one key that can cancel the grant. Staff built and ran a procedure for that case. The last send the exchange marks as unauthorized, 2,961.9 ether, landed in a block at 23:56 UTC after sitting pending. At 00:10 UTC on 30 October, a new authorization from the hot wallet labeled Binance14 to the zero address cleared the delegation.
The freeze and the refill
Binance’s update puts assets involved near $6.34 billion and the frozen or intercepted portion near $2.85 billion, a sum that can still move with reconciliation and prices. As of 31 October, 98 percent of the affected tokens had been refilled, visible on the proof-of-reserves page. The reserve set aside is larger than the loss. Buying continues for the less liquid tokens still missing. The loss sits with Binance, not with users.
Binance, citing the latest FBI release, says the bureau indicates North Korea is responsible. PTYcoin’s report on that attribution is here.
Repairs underway
By 3 November, Binance says, it had stood the affected wallet software up again in a separate environment, rebuilt the internal AI tool and its access rules, swapped the machines involved, and retired the logins and tokens on that path. Staff devices were scanned again. AI checks for odd behavior were widened, and controls on the wallet service were tightened. Outside cybersecurity firms are coming in to review the break-in and the exchange’s own findings. It is adding budget for AI detection, endpoint defense, and developer machines, and it is working on a research fund with AI companies and security firms.
