Cryptocurrency exchange Binance has revealed new circumstances of the massive hacker attack on October 29, as a result of which attackers withdrew digital assets worth about $6.34 billion. It turned out that preparation for the hack began back in the summer, and a fake job interview with an employee and an internal artificial intelligence tool helped the hackers gain access to the exchange's critical systems.
Binance reported this on November 3, publishing preliminary investigation results. Details are also provided by the industry publication The Block.
According to Binance, the attack was a multi-stage operation that lasted several months. The attackers used social engineering methods, malicious software, stolen credentials, and compromised internal company tools.
The first signs of preparation were discovered back in June 2026. One of the engineers in the division responsible for cryptocurrency wallet infrastructure downloaded a modified Homebrew installation package while trying to install a popular AI-powered programming tool.
Binance's security service detected suspicious activity, replaced the employee's device, and updated associated credentials. However, the attackers had already managed to obtain information about his position and colleagues who had access to wallet infrastructure.
The next stage began in September. The hackers contacted another engineer through a genuine job search platform, posing as representatives of a fictitious company.
The employee went through two interview stages. First, a person posing as a recruiter spoke with him via video link. Then an interview took place with the supposed head of the company.
At the end of the second interview, the engineer was offered to download a test assignment with program code onto his work computer. The file contained malicious software that launched during project setup and gave the attackers access to the device.
According to Binance, the program exploited a previously unknown vulnerability and obfuscation methods, so the installed security tools did not detect the infection.
On October 20, the hackers used the compromised computer and Binance's internal AI tool to gain control over devices of two more engineers. On one of the computers, they found an access token that allowed deploying software containers.
On October 29, the attackers used the stolen credentials and launched malicious code, gaining unauthorized access to the internal service confirming cryptocurrency wallet transactions.
After that, the withdrawal of digital assets began. In particular, 233.46 million XRP, about 970.5 thousand SOL, 44.2 million OP, and 18,270 BTC were transferred from the exchange's hot wallets.
In addition, the attackers used the Ethereum authorization mechanism EIP-7702, giving a smart contract they controlled the ability to perform transactions with one of the exchange's wallets.
Because of this, simply halting withdrawals did not allow for the immediate cessation of all unauthorized transfers. The company required additional technical actions to revoke the permissions granted by the attackers.
The last illegal transaction was finally confirmed on the blockchain at 23:56 UTC on October 29. After that, the company no longer detected new unauthorized transfers.
As of November 3, Binance had managed to freeze or intercept digital assets worth about $2.85 billion. The company declared that it would fully bear the financial consequences of the attack.
To cover losses, the exchange reserved funds exceeding 100% of the damage amount. As of October 31, it restored 98% of affected token assets and continues to purchase the remaining less liquid tokens. However, the restoration of reserves does not mean that all stolen funds were recovered.
Binance has already rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices, and revoked associated credentials. The company has also strengthened transaction monitoring and intends to engage independent experts to verify the investigation results.
The U.S. Federal Bureau of Investigation linked the attack to the North Korean hacker group TraderTraitor. According to the FBI, the attackers are converting stolen assets into Ethereum and may use decentralized financial services to further obfuscate the origin of funds. North Korea has rejected the US accusations.
Earlier, Kurs Ukrainy reported on suspicious transfers from Binance wallets on October 29. Then exchange founder Changpeng Zhao admitted that a hack could have been the cause of the large-scale cryptocurrency movement.
