Binance has disclosed that the $6.34 billion Binance crypto heist, which the FBI has attributed to North Korea, was the product of a patient operation that began months before the October 29 theft. The exchange said its investigation revealed a chain of compromises that started with a single infected download in June and ended with attackers moving through internal systems to trigger the massive withdrawal.
How the intrusion began
According to Binance, a Wallet DevOps engineer working on the exchange’s wallet infrastructure searched for and installed a tampered version of a widely used AI coding tool in June. The altered homebrew package gave the attackers a foothold, and while Binance detected the anomaly and responded at the time, the episode exposed information about the engineer’s colleagues to the intruders.
The operation escalated in September, when a different Binance software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. The engineer participated in two interview rounds. The first was a live video session with a purported HR representative who shared a personal social media account to appear credible. The second was conducted over a chat app with the supposed CEO of a company that did not exist.
That fake executive then sent the engineer a work assignment. When the engineer downloaded and began setting up the file, malware embedded in it executed. Binance described the malicious code as using advanced obfuscation and evasion methods. It swapped out a genuine development tool component for a malicious one to run commands, and it hid its activity while erasing evidence of the compromise as it progressed.
From one laptop to the wallet system
On October 20, the attackers pivoted from the software engineer’s compromised machine. Using an internal AI tool, they gained control of computers belonging to the Wallet DevOps engineer and another engineer on the same team. Nine days later, they logged into that third engineer’s computer, applied credentials stolen from the Wallet DevOps engineer, and launched a malicious script that set the theft in motion.
Binance acknowledged that asset movement continued even after it halted withdrawals, because those transactions had already been authorized. Of the $6.34 billion in digital assets affected, $2.85 billion has been frozen.
Remediation and financial response
As of November 3, Binance said it had rebuilt the affected wallet system and internal AI tools, replaced compromised devices, decommissioned exposed credentials and tokens, completed enhanced security scans across employee devices, and added AI-powered anomaly detection to its systems.
The exchange also said it will absorb the financial losses from the attack and has set aside sufficient funds to cover the stolen assets. It has already restored 98 percent of the affected token assets and is purchasing the remaining, less liquid holdings.
