The attack began in June, when an employee on Binance’s wallet development team downloaded a compromised software package while setting up an AI coding tool. The exchange said it detected the malware, replaced the affected device and changed credentials. However, the attackers had already gathered information about the wallet team and its internal systems.
In September, hackers posing as recruiters targeted another engineer who was looking for a new job. They invited the employee to a series of fake interviews, including a virtual meeting with the supposed CEO of a fictitious company. During a later interview, the engineer was asked to download what appeared to be a coding assignment. The file contained malicious software that compromised the employee’s work computer and evaded security detection.
The attackers then used the compromised device alongside an internal AI tool to gain access to two other engineers’ computers on October 20. Nine days later, they used stolen deployment credentials to execute a malicious script within Binance’s wallet infrastructure.
The breach gave the attackers access to the exchange’s internal wallet-signing service, which authorizes cryptocurrency transactions. Binance said the hackers exploited this access to move funds without following the platform’s normal withdrawal procedures.
The theft began on October 29, when attackers transferred 233.46 million XRP from five internet-connected Binance wallets to an address under their control in just four minutes. They subsequently moved other cryptocurrencies, including Bitcoin. The unauthorized transfers continued for nearly four hours, with the final one recorded at 23:56 GMT, according to the exchange.
Binance said the attackers also exploited Ethereum’s EIP-7702 mechanism, which allows externally owned wallets to delegate certain transaction permissions to smart contracts. The mechanism enabled unauthorized transfers to continue even after the exchange suspended withdrawals. Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, also complicated efforts to revoke the permissions.
Read also : Binance heist: How were cryptocurrency billions stolen?
The exchange suspended withdrawals globally while investigating the breach, then moved to freeze affected assets and remove unauthorized permissions. It said approximately $2.85 billion had been frozen or intercepted. Binance also pledged to cover the losses rather than pass them on to customers, reporting that it had replenished 98% of the affected token assets by October 31.
In its report, the company apologized for the disruption and uncertainty caused by the incident, describing it as a serious security breach that should not have happened. It also announced plans to increase investment in AI-powered threat detection, bring in external cybersecurity experts for a full review and establish a security research fund.
