Binance Details Breach Path in $6.34 Billion Hot Wallet Theft

Binance published its initial post-incident review detailing the four-month security compromise that culminated in the Oct. 29 theft of roughly $6.34 billion in digital assets ¹. According to the exchange, the campaign began in June when a wallet DevOps engineer downloaded a tampered Homebrew package while searching for an artificial intelligence coding tool ¹. While Binance detected the initial compromise, replaced the engineer's device, and reset credentials, the attacker retained exposure across the wallet infrastructure team ¹.

In September, an attacker contacted a second engineer through a recruitment platform under the guise of an executive interview ¹. Following a live video screening, the engineer was directed during an assessment to download a repository containing zero-day malware onto a company-issued computer ¹. Binance stated that the malware bypassed endpoint detection tools ¹. By Oct. 20, the intruder leveraged the compromised device alongside an internal AI tool to pivot into the machines of the initial engineer and a third team member, ultimately securing a container deployment token ¹. The incident follows reports where the FBI blamed North Korea for the multi-billion exploit targeting the platform.

Execution and EIP-7702 Delegation

On Oct. 29, the perpetrator deployed a container and initiated malicious scripts using the compromised third engineer's environment ¹. Unauthorized outbound transactions began at 20:05 UTC, draining 233.46 million $XRP alongside approximately 970,500 $SOL, 44.2 million $OP, and 18,270 $BTC across multiple hot wallets ¹.

The attacker then used Binance's internal signing service to exploit Ethereum's EIP-7702 standard, granting an external smart contract partial authority over an Ethereum hot wallet across 50 signing transactions ¹. Because the infrastructure utilized multi-party computation (MPC), single-key revocations were ineffective, forcing the exchange's engineering team to draft a custom remediation process to cancel the delegations ¹. The final unauthorized transfer of 2,961.9 $ETH cleared at 23:56 UTC, and the delegations were fully neutralized at 00:10 UTC on Oct. 30 ¹.

Binance reported that it has rebuilt the affected wallet infrastructure, decommissioned compromised internal tools, and initiated an independent third-party audit ¹. While Binance noted in the report that 98% of impacted assets were replenished by Oct. 31, separate exchange updates reported recovery levels at 90% on Oct. 31 and roughly 95% on Nov. 2, following its previous decision to allocate corporate capital to absorb the losses ¹.