04.11.2026 11:33
Cryptocurrency exchange Binance shared its initial investigation report regarding the approximately $6.34 billion attack that occurred on October 29. According to the report, the attackers, through months of preparation, first had malware installed on an engineer's computer via a fake job interview, and then reached the wallet systems by exploiting an artificial intelligence tool within the company.
The exchange's report indicates that the theft on October 29 did not occur through a single security breach. Attempts to deceive employees, malware, and stolen access credentials followed one another. Binance stated that the investigation is ongoing and that the findings will also be reviewed separately by independent experts.
COMPUTER BREACHED THROUGH A FAKE JOB INTERVIEW
The first attempt targeted an engineer working on the wallet infrastructure in June. While searching to install an AI coding tool, the engineer downloaded a modified Homebrew installer file. The security team detected the unusual situation, replaced the computer, and renewed the relevant access credentials. However, according to Binance, the attacker had learned about the employee's role and information regarding colleagues on the same team.
In September, another software engineer was contacted through a real job-search platform. Individuals presenting themselves as executives of a fictitious company conducted a two-stage interview with the employee. The HR representative in the first interview also shared a social media account containing personal photos and videos to build trust.
At the end of the second interview, the engineer was asked to download a software assignment onto the work computer. During installation, malicious code altered a component of a legitimate development tool on the computer. The company reported that the malware was not detected by the security tools on the device at the time and that it erased its traces by concealing its activities.
On October 20, the attacker used the compromised computer and an internal AI tool to further access the devices of two engineers on the wallet team. One of them contained an authorization credential used to run software on the system.
Nine days later, a malicious script was executed using these credentials. The attacker thus reached the internal service that signs wallet transactions and initiated transfers outside the normal withdrawal process. According to the report, the intrusion that began with employee devices progressed to the stage where assets were moved through the combined use of privileges across different systems.
STOPPING WITHDRAWALS DID NOT IMMEDIATELY HALT TRANSFERS
Binance's suspension of withdrawals was not enough to prevent all unauthorized transfers on Ethereum. Through a feature called EIP-7702, the attacker had granted a smart contract under their control the authority to transact on behalf of one of the exchange's hot wallets.
Because this authorization was valid directly on the network, it did not disappear when normal withdrawal services were shut down. The exchange had to perform additional transactions to revoke the authorization. Due to the wallet's structure, which distributed signing authority among multiple parties, there was no single private key that could be used immediately for revocation. The team's preparation of a special revocation procedure prolonged the intervention.
The report stated that the last unauthorized transfer was a transaction of approximately 2,962 ETH that had previously been sent to the network and remained pending. Binance announced that the malicious authorization on the relevant wallet was later cleaned up.
The exchange reported that it had closed the entry points used in the attack, set up the affected wallet system in a new environment, and renewed the internal AI tool along with access controls. The compromised devices were replaced, the relevant employees' access credentials were revoked, and additional security scans were performed on employee devices.
Binance will ask independent cybersecurity experts to comprehensively examine the incident and verify the initial findings. The company also announced that it will increase investments in protecting developer environments and detecting unusual behavior, and that it is working on a research fund focused on AI security.