Binance Security Report Lays Out Month-Long Attack Chain Behind $6.34 Billion Crypto Heist
Binance Security Report Lays Out Month-Long Attack Chain Behind $6.34 Billion Crypto Heist #
Binance has released a detailed post-incident security report outlining how attackers spent months infiltrating its systems before executing the largest cryptocurrency theft on record, a $6.34 billion heist on 29 October.
The report, published Tuesday, describes a multi-stage operation that began as early as June. In that first phase, one of Binance’s wallet development engineers downloaded a tampered version of a popular AI coding tool after being directed to a poisoned installation package. Binance’s security team detected the anomaly and replaced the device, but the attackers had by then established a foothold in the exchange’s environment.
The second phase unfolded in September, when the same group posed as corporate recruiters and conducted a staged job-interview process with a different Binance engineer. The ruse involved two contacts: a supposed human resources representative who shared social-media profiles to build credibility, followed by a second individual posing as a CEO who persuaded the engineer to download a malware-laced file as part of an interview coding assessment.
By 20 October, the attackers leveraged a compromised internal AI tool to reach two of Binance’s wallet-infrastructure engineers and obtain a container deployment permission token. That credential gave them entry into the exchange’s wallet-signing operations. On 29 October they exploited Ethereum’s EIP-7702 delegation mechanism (which allows an account to grant partial execution rights to a smart contract without exposing a private key) to authorise unauthorised transactions across at least four blockchain networks.
Binance co-CEO Richard Teng, speaking to CNBC, pushed back on suggestions that a single compromised laptop was the root cause. The attackers “spent months building their way in,” he said, noting they also deployed a self-destruct mechanism to erase their tooling and obscure their tracks once the theft was complete.
As of the report’s publication, Binance said approximately $2.85 billion of the stolen assets had been frozen or intercepted, subject to reconciliation and market price movements. The exchange added that it had replenished 98 percent of affected customer holdings from its own funds, and that independent security firms have been engaged to review its findings. Certain technical details will remain confidential, it said, to avoid providing a blueprint for future attacks.
The FBI has separately attributed the breach to North Korea’s TraderTraitor hacking unit, a conclusion also reached by blockchain analytics firms. Binance said its investigation remains ongoing and that further updates will follow.
Copy link