According to a preliminary report, it all began in June. A Binance engineer was setting up an AI coding tool and downloaded a modified installer for Homebrew, a popular package manager for macOS. The exchange detected it, replaced the device and changed the credentials, but the attackers had already managed to find out who at the company was responsible for the wallets.

In September, a fake recruiter on a job-search website conducted a video interview with an employee and sent them a repository containing a “test assignment.” It contained malware that exploited a zero-day vulnerability, which the security protections on work devices failed to detect. On October 20, the attacker used Binance’s internal AI tool as a foothold and obtained a token for deploying containers. On October 29, the attacker deployed a container and launched the attack from it.

Through an internal transaction-signing service, the attacker withdrew funds while bypassing the usual procedure. In four minutes, from 20:05 to 20:09 UTC, five hot wallets—that is, wallets constantly connected to the network—sent 233.46 million #XRP to the attacker’s address. Then about 970,500 $SOL , 44.2 million #OP , and 18,270 $BTC were sent.

On the Ethereum network, a hacker exploited the EIP-7702 mechanism, which allows a regular wallet to delegate some of its authority to a smart contract. Using 50 signed transactions, the hacker granted a malicious contract permission to control a hot wallet. Halting withdrawals did not revoke those permissions on the blockchain. The wallet used multi-party computation (MPC), which has no single private key that could be quickly revoked. The final transfer of 2,961.9 $ETH went through at 23:56 UTC, and Binance did not revoke the delegation until 00:10 UTC on October 30.

According to the exchange, by October 31, 98% of the affected tokens had been recovered, while about $2.85 billion had been frozen or intercepted. Binance says it has reserved more than 100% of the amount needed to cover the losses, and that users will lose nothing. The company apologized and acknowledged that the incident should not have happened. According to the FBI, North Korea was behind the attack. Binance itself said it had blocked 57 threats over the past year that were believed to be linked to North Korea.

After the attack, Binance restored its wallet system and AI tool, replaced devices, revoked credentials, and checked all employees’ equipment. The exchange will also commission an independent audit and create an AI security research fund with partners.