Binance has linked its October 29 security breach to a months-long operation involving social engineering, compromised software, and stolen credentials.
The attackers exploited weaknesses in employee security to gain access to critical wallet operations.
They also misused an internal AI tool to reach wallet developers and execute unauthorized transactions. The incident has raised fresh questions about insider access, cybersecurity controls, and the risks facing centralized crypto exchanges.
Binance traces $6.3B hack to compromised software and fake interviews
In an incident report published on November 3, Binance outlined how attackers prepared the $6.3 billion theft over several months. The operation reportedly began in June when a wallet engineer downloaded a tampered installer while setting up an AI coding tool.
Binance detected the malware, replaced the engineer’s laptop, and reset his login credentials. However, the attackers had already identified his position within the exchange.
The operation continued in September when another engineer attended two interviews with a fake company. During the recruitment process, he downloaded a malicious coding assignment that compromised his computer.
On October 20, attackers reportedly used the compromised device alongside an internal AI tool. They exploited this access to reach two wallet developers within Binance.
By October 29, the attackers had combined stolen credentials with a malicious script to access wallet-signing operations. Binance identified this sequence as the final stage of the operation that enabled the theft.
Attackers move 233.46 million XRP across five wallets
Once inside Binance’s wallet infrastructure, the attackers moved quickly to transfer the stolen assets. Five active wallets transferred approximately 233.46 million XRP within four minutes.
The attackers subsequently moved Bitcoin and other cryptocurrencies from the compromised wallets. Binance blocked the withdrawal of funds, but the stolen on-chain permissions remained active.
According to the incident report, terminating those permissions required a separate process. Consequently, the final unauthorized transaction occurred almost four hours after the initial XRP transfers.
Meanwhile, Reuters reported on October 31 that the FBI attributed the attack to North Korea’s TraderTraitor hacking group. North Korea subsequently denied the allegations, according to the news agency.
Binance also disclosed progress in freezing affected assets. The exchange said it had frozen or intercepted approximately $2.85 billion linked to the incident.
By October 31, Binance had restored 98% of affected token assets. However, customer asset restoration does not necessarily mean the exchange recovered the stolen cryptocurrency.
Elliptic estimated that approximately $3.18 billion remained in wallets associated with the theft, primarily Bitcoin and Ether.
Blockchain investigators also faced challenges tracking the stolen funds. Elliptic traced approximately 12,000 wallets across 11 blockchains and more than 40,000 transactions within three and a half days.
TRM Labs identified self-minted tokens and chained bridges that complicated wallet tracking. Chainalysis also observed addresses funded with exactly 1 TRX, suggesting automated transfers.
Crypto markets stabilize as Binance records $4.72B outflows
The Binance hack initially pressured cryptocurrency markets before prices stabilized. Bitwise recorded declines of up to 5% for Bitcoin and 6.1% for Ether. However, the asset manager described trading activity as sharp but orderly.
Bitcoin subsequently recovered above $77,000. Nevertheless, market stabilization did not prevent customers from withdrawing funds from Binance.
After withdrawals resumed, the exchange recorded $4.72 billion in net outflows, despite receiving $2.7 billion in returning funds, Cryptopolitan reported.
Binance’s October 31 reserves snapshot showed at least one-to-one backing for ten major tokens. However, the snapshot did not constitute a comprehensive solvency audit.
The incident also renewed discussions about cryptocurrency custody. DeFi Technologies’ Andrew Forson favored exchange-traded products because investors have an institution to contact when problems arise.
Septten Advisors’ Soham Jethani warned that regulation alone cannot eliminate exchange custody risks. Grayscale also highlighted institutional custody, although investors still face market and custodian-related risks.
Binance said it would strengthen AI-based monitoring and commission independent security reviews. The effectiveness of these measures will depend on whether they prevent unauthorized access before another theft occurs.
