Binance Initial Report: FBI Attributes $6.34 Billion Attack to North Korea, Which Used Fake Job Interviews and an AI Tool to Reach Hot Wallets; Users Fully Covered
Binance has published its initial report on the October 29 security incident, revealing that attackers spent months working their way into its systems through a supply-chain compromise, fake job interviews and an internal AI tool before taking control of hot wallets. The Federal Bureau of Investigation has attributed the attack to North Korea, according to Binance. The exchange said it will absorb the financial impact of the stolen funds, not users, and has already set aside more than 100% of the amount needed.“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.Users Fully CoveredAbout $6.34 billion in digital assets were affected, and about $2.85 billion has been frozen or intercepted so far, subject to reconciliation and price movements. Binance said 98% of the affected token assets have been replenished and can be verified on its Proof of Reserves page, and that it is buying the remaining, less liquid tokens.A Months-Long CampaignBinance described a sophisticated, multi-stage campaign rather than a single breach or a simple phishing attack.June: An engineer on the wallet infrastructure team downloaded a tampered installer while setting up a popular AI coding tool. Binance’s security team detected the problem, replaced the device and rotated credentials, but the engineer’s role and colleagues had already been exposed to the attackers.September: A second engineer was approached on a legitimate job platform by someone posing as a project director. After two rounds of interviews, including a live video call designed to build trust, he was told to download a coding “assignment” onto his work computer. It contained malware that was not detected by endpoint security tools at the time.October 20: Using the compromised computer, the attackers used an internal AI tool to reach two wallet engineers, and found a container deployment permission on one of their machines.October 29: Between 17:15 and 19:56 UTC, the attackers logged into an engineer’s computer, used stolen credentials to deploy a container and launched the attack.Binance said its security team had already detected and blocked 57 suspected North Korea-linked threats in 2026, using techniques such as fake job interviews, malicious software disguised as developer tools and fake video-conferencing apps.How the Funds Were TakenThe attackers used unauthorized access to an internal wallet signing service to start transactions outside Binance’s normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets also sent about 970,500 SOL, 44.2 million OP and 18,270 BTC.The attackers then exploited EIP-7702, an Ethereum feature that lets an account delegate certain execution rights to a smart contract without exposing its private key. They submitted 50 signing transactions to set up malicious delegations giving an attacker-controlled contract partial control of a hot wallet.Why Containment Took HoursBinance paused withdrawals, worked with partners to freeze tokens and moved to revoke the unauthorized permissions. But the malicious delegations existed on-chain and operated independently of Binance’s withdrawal systems, so pausing withdrawals alone could not stop every transfer. Because the hot wallet used multi-party computation, there was no single private key that could instantly revoke them, and the team had to build a specialized procedure. The final unauthorized transfer, of 2,961.9 ETH, settled at 23:56 UTC, and Binance cleared the malicious delegation at 00:10 UTC on October 30.What Binance Has FixedAs of November 3, Binance said it has:Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and its access controls.Replaced affected devices and retired related credentials.Completed enhanced security scans across all employee devices.Strengthened AI-based anomaly detection and wallet risk controls.Next StepsBinance is engaging independent cybersecurity firms to review the incident and validate its findings, increasing investment in AI-based security, and working to set up a security research fund with AI companies and security firms focused on AI security in blockchain. “Security improves when the industry learns together,” the exchange said, adding that some technical details will remain confidential to avoid helping future attackers.
