Binance reveals how hackers infiltrated the system through fake interviews and an AI tool

The company notes that the attack was multi-stage. The attackers combined social engineering, malware, compromise of an internal AI tool, and methods to bypass the standard withdrawal process.

According to Binance, the US Federal Bureau of Investigation is blaming North Korea for the incident.

How the attack happened

The attackers took advantage of unauthorized access to the wallets' internal signing service, which allowed them to initiate transactions outside of the normal withdrawal process.

Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to an address controlled by the attackers. Subsequently, the exchange’s wallets on the Solana and Optimism networks sent approximately 970,500 SOL and 44.2 million OP. One of the hot wallets also transferred 18,270 BTC.

A separate stage was the exploitation of the EIP-7702 authorization mechanism in Ethereum. It allows an account to delegate certain rights to a smart contract to perform operations without revealing the private key. In this case, the attackers granted partial rights to a smart contract under their control to perform operations with a Binance hot wallet.

After detecting large transfers, the exchange suspended withdrawals, worked with partners to freeze assets, and revoke unauthorized permissions. In total, approximately $2.85 billion in assets were frozen or seized.

Binance explains that simply stopping withdrawals wasn’t enough: the malicious EIP-7702 permissions already existed on the blockchain and could operate independently of the exchange’s regular infrastructure. Due to the use of multi-party computation (MPC) technology, there was no single private key that could instantly revoke these permissions. The team developed a special procedure to revoke them.

The last unauthorized transfer of 2961.9 ETH ended on the blockchain at 23:56 UTC. At 00:10 UTC on October 30, Binance performed a new authorization that cleared the delegated code EIP-7702.

Fake interviews and malicious test tasks

In the report, Binance describes several stages of the attack preparation. According to the company, back in June 2026, one of the Wallet DevOps engineers downloaded a modified version of Homebrew in an attempt to install the popular AI programming tool after searching for it in a search engine. The security team discovered the anomaly, replaced the device, and changed the associated credentials. However, as Binance notes, the engineer’s role and his connections to colleagues working on the wallet infrastructure may have already been known to the attackers.

In September, another Binance employee received an interview offer via a legitimate job search platform. The interviewer introduced himself as a project manager for a fictional company. The first interview was a video interview with a person who identified himself as an HR representative and showed his own social media profile with personal photos and videos to establish trust.

The second stage of the interview was conducted in a popular messenger. At the end, the candidate was asked to download a test task — a repository with malicious code. While setting up the project, he launched unauthorized actions on his work computer.

The malware replaced a component of a legitimate development tool, executed commands, and established communication with an external server under the attackers' control. Binance notes that at the time of the attack, existing endpoint protection tools did not detect this zero-day malware.

On October 20, the attackers used the engineer’s already compromised computer and the company’s internal AI tool to gain control of the accounts of two more Wallet DevOps and Wallet Software employees. In particular, they discovered a container deployment token on the computer of one of the engineers.

On October 29, the attackers logged into the computer of a third employee, used stolen credentials, deployed a container, and launched a malicious script that allowed them to proceed to attack transaction signing operations.

What Binance is doing after the attack

As of November 3, the company says it has rebuilt the affected wallet system and internal AI tool in a new environment, replaced compromised devices, revoked credentials and tokens associated with the incident, and conducted additional checks on employee devices.

Binance has also strengthened risk controls across its wallet services and expanded its use of AI to detect anomalous behavior. The company is working with law enforcement, blockchain analytics firms, and industry partners to track and freeze stolen assets.

The exchange said it has already reserved more than 100% of the funds needed to cover user losses. As of October 31, 98% of the affected tokens have been restored, which can be checked via the Proof of Reserves page. The company plans to buy back the remaining assets, which are less liquid.

Binance is also engaging independent cybersecurity experts to conduct a comprehensive audit of the incident. Next steps include increasing investment in AI security, securing development environments and monitoring behavioral anomalies, as well as establishing a fund for security research and industry initiatives.

Earlier, dev.ua wrote that the FBI officially accused North Korea of ​​the attack on Binance, during which they stole more than $6 billion. According to the bureau, the hacker group TraderTraitor is behind the hack. The attackers mainly transferred the stolen assets to Ethereum in order to further launder them through cryptocurrency services.

Binance compensated 95% of losses after the security incident and restored confirmation of reserves.

Binance also announced that they plan to take a new snapshot of reserves on November 4, which will cover a wider range of tokens. Processing and generating an updated zero-knowledge proof for it will take approximately 40 to 50 hours due to high computational workloads.

Binance reimburses 95% of losses after security incident and restores confirmation of reserves

On the topic

Binance reimburses 95% of losses after security incident and restores confirmation of reserves