Attackers infiltrated Binance's wallet infrastructure through malicious software and stolen credentials before exploiting Ethereum's EIP-7702 mechanism.
Binance said attackers behind the $6.34 billion hack on October 29 used a fraudulent job interview, malicious software and a compromised internal AI tool to infiltrate its wallet infrastructure, according to an initial investigation report released Tuesday.
The attack began taking shape in September when a Binance software engineer was approached through a legitimate recruitment platform by someone posing as a project director. During a subsequent interview, the engineer was instructed to download a coding assignment containing malware onto his work computer.
The malicious code replaced a legitimate development tool component, allowing the attackers to execute commands and communicate with an external server. Binance said its endpoint security tools failed to detect the previously unknown malware.
By October 20, the attackers had used the compromised computer and an internal AI tool to gain access to two additional engineers, obtaining a deployment permission token that provided a path into the exchange’s wallet infrastructure.
On October 29, the attackers used stolen credentials to deploy a container and execute a malicious script, gaining unauthorized access to Binance’s internal wallet signing service.
Hackers exploited Ethereum authorization mechanism
The attackers used the compromised signing service to initiate unauthorized transfers across multiple blockchains, including 18,270 BTC, approximately 970,500 SOL, 233.46 million XRP and 44.2 million OP.
They also exploited Ethereum’s EIP-7702 mechanism, which allows accounts to delegate execution rights to smart contracts. The attackers submitted 50 signing transactions to establish malicious authorizations that enabled them to move funds independently of Binance’s withdrawal infrastructure.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Binance suspended withdrawals and attempted to revoke the permissions, but the existing blockchain authorizations remained active. The exchange said its use of multiparty computation wallets complicated the process of removing the malicious permissions.
The final unauthorized transfer of 2,961.9 ETH was completed at 23:56 UTC on October 29. Binance revoked the affected wallet’s malicious delegation shortly after midnight on October 30.
Binance replenishes 98% of affected tokens
Binance said approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of affected token assets had been replenished as of October 31.
The exchange said it had allocated more than enough funds to cover the losses and was purchasing the remaining less liquid assets.
Binance has since rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices and revoked exposed credentials. It is also engaging independent cybersecurity firms to review the incident.
The FBI attributed the theft to North Korea’s TraderTraitor hacking operation, warning that stolen assets were being converted into Ether and could be laundered through decentralized finance platforms.
North Korea has denied involvement in the attack.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.