Crypto
Binance Explains $6.34B Crypto Hack Involving Malware and AI
Binance’s first report on the October 29 breach traces the attack back to a fake recruiter, a poisoned coding assignment and a misused Ethereum feature.
BLOCKINSIDERLoadingBinance’s first report on the October 29 breach traces the attack back to a fake recruiter, a poisoned coding assignment and a misused Ethereum feature.
Binance has published its first report on the October 29 security incident. The crypto hack looted almost $6.34 billion worth of crypto from Binance’s hot wallets.
According to Binance, it started months earlier with a tampered software download and a job interview that never existed. Binance says users will not carry the loss. The exchange set aside more than 100% of the required funds and will absorb the hit itself.
The groundwork began in June 2026. An engineer on Binance’s Wallet DevOps team, referred to as Engineer A, searched online for a popular AI coding tool and downloaded a tampered Homebrew installation.
The security team caught the anomaly, replaced the device, and rotated credentials. By then, the attackers knew who worked on Binance’s wallet infrastructure.
In September, a software engineer referred to as Engineer B was approached on a legitimate job-hunting platform by someone posing as a Project Director. His profile mentioned his work at Binance.
A two-round hiring process followed. A fake HR representative ran a live video interview and shared a social media account full of personal photos and videos to build trust.
A second interview with a supposed CEO took place in a chat app, and near the end Engineer B was told to download an “assignment” onto his work computer. That repository carried 0-day malware.
During setup, it swapped a legitimate pyenv component for a malicious version, opened a line to an attacker-controlled server, and cleaned up its own traces. Binance’s endpoint protection tools did not catch it at the time.
Binance says it blocked 57 suspected North Korea-linked attempts across 2026. Many used the same playbook of fake interviews, poisoned developer tools, and bogus video call apps. This one got through and grew into a crypto hack worth billions.
On October 20, the attackers used Engineer B’s compromised machine and an internal AI tool to gain control over Engineer A and a third wallet engineer, Engineer C. On Engineer A’s computer, they found a container deployment permission token.
On October 29, between 17:15 and 19:56, the attacker logged onto Engineer C’s computer, used Engineer A’s stolen credentials, deployed a container and ran a malicious script.
That gave them access to an internal wallet signing service, which they used to push transactions outside the normal withdrawal process.
The outflows started at 20:05 UTC. Within four minutes, five Binance hot wallets sent 233.46 million XRP to the attacker. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP, followed by 18,270 BTC.
The attacker then turned to Ethereum’s EIP-7702, which allows an account to hand certain execution rights to a smart contract without exposing its private key.
Through 50 signing transactions that manipulated the account nonce, they set up delegations giving an attacker-controlled contract partial control of a Binance hot wallet.
This is what stretched the crypto hack over several hours. Suspending withdrawals did nothing to authorizations already living on-chain. The wallet used multi-party computation, so there was no single private key to revoke them quickly, and the team had to build a special procedure.
The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the delegation code.
Working with partners, law enforcement and blockchain intelligence firms, Binance froze or intercepted about $2.85 billion of the stolen assets.
The exchange says it has closed the entry points and rebuilt both the affected wallet system and the internal AI tool. It has also replaced devices and retired credentials tied to the affected engineers.
Device and wallet-service risk controls are tighter, and AI-based anomaly detection now covers more ground.
Independent security firms will review the incident, and Binance plans a security research fund with AI companies and industry partners focused on AI security in blockchain environments.
Not everyone accepts the “highly sophisticated” framing. The founder of CoinEx argued on X that three avoidable mistakes made the crypto hack possible.
Production access was not isolated on a dedicated machine. A single key could operate production services with no hardware-key second factor.
And the MPC setup behaved like a single signature, since the signers did not independently verify transactions. “None of these require sophisticated technology,” he wrote. “What was missing was discipline.”
Ilya Lichtenstein, who stole about 120,000 BTC from Bitfinex in 2016 and now says he works as a white-hat hacker, told CNN on November 1 that the attack matched North Korean tactics of hunting for the weakest human link.
He said the first 48 hours matter most for tracing funds. AI agents can move money faster, but blockchain records stay traceable for years. For other exchanges, the lesson is uncomfortable. A crypto hack of this size began with a recruiter message and a homework file.
No comments yet
