🔴 How Did the Binance $6.3B Hack Happen? Five Months of Infiltration, 20 Minutes to Steal

June: A wallet DevOps engineer trying to install an AI coding tool accidentally downloaded a tampered Homebrew installer.

September: A fake recruiter approached another engineer under the guise of a job interview and asked them to download a malicious code repository.

Oct 20: Using those computers and Binance’s internal AI tool, they compromised the machines of two more engineers. They also obtained a token that allowed them to deploy containers.

Oct 29: Using credentials stolen from Engineer C’s computer, they deployed a container and ran a malicious script. It reached Binance’s internal wallet signing service and bypassed the usual withdrawal checks.

On Ethereum, 50 pre-signed EIP-7702 authorizations handed hot wallet Binance 14 over to the attacker’s contract, which drained it of 167,464 ETH + 1.615B USDT. Across 10 other chains, the total was around ~$6.34B, including 233.46M XRP, ~970,500 SOL, and 18,270 BTC—most of it drained within 20 minutes.

Why didn’t suspending withdrawals stop it? The malicious EIP-7702 delegations were already on the blockchain; the MPC wallet had no single private key that could revoke them, so they required a special procedure to resolve.

Who was behind it? TRM Labs and the FBI attributed it to North Korea’s TraderTraitor group (the same group behind the Bybit $1.5B theft), while North Korea denies involvement. Binance says it found no evidence of a private key leak.

As of now: ~$2.85B has been frozen or intercepted, and Binance says it has replenished around 98% of the funds.

Note: This is based on Binance’s Nov 3 preliminary report and information from TRM Labs and the FBI; a full post-mortem and independent review have not yet been released.