🔴 How Did the Binance $6.3B Hack Happen? A 5-month intrusion, stolen in 20 minutes
June: A Wallet DevOps engineer trying to set up an AI coding tool downloaded a tampered Homebrew installer.
September: A fake recruiter approached another engineer with a fake job interview and got them to download a malicious code repo.
Oct 20: Using those computers and Binance's internal AI tool, attackers took over two more engineers' machines. They also got a token with container deployment permission.
Oct 29: From Engineer C's computer, using stolen credentials, they deployed a container and ran a malicious script. That reached Binance's internal wallet signing service and bypassed normal withdrawal checks.
On Ethereum, 50 pre-signed EIP-7702 authorizations delegated hot wallet Binance 14 to the attacker's contract, sweeping 167,464 ETH + 1.615B USDT. Across 10 chains, including 233.46M XRP, ~970,500 SOL, 18,270 BTC, total ~$6.34B, most within 20 minutes.
Why didn't suspending withdrawals stop it? The malicious EIP-7702 delegations were already on-chain, and the MPC wallet has no single private key to revoke — it needed a special procedure.
Who? TRM Labs and the FBI attribute it to North Korea's TraderTraitor (same group as the Bybit $1.5B theft); North Korea denies it. Binance says it found no evidence of a private key leak.
Now: ~$2.85B frozen/intercepted, Binance says ~98% replenished.
Note: This is based on Binance's Nov 3 preliminary report + TRM Labs/FBI findings; the full post-mortem and independent review are not out yet.
June: A Wallet DevOps engineer trying to set up an AI coding tool downloaded a tampered Homebrew installer.
September: A fake recruiter approached another engineer with a fake job interview and got them to download a malicious code repo.
Oct 20: Using those computers and Binance's internal AI tool, attackers took over two more engineers' machines. They also got a token with container deployment permission.
Oct 29: From Engineer C's computer, using stolen credentials, they deployed a container and ran a malicious script. That reached Binance's internal wallet signing service and bypassed normal withdrawal checks.
On Ethereum, 50 pre-signed EIP-7702 authorizations delegated hot wallet Binance 14 to the attacker's contract, sweeping 167,464 ETH + 1.615B USDT. Across 10 chains, including 233.46M XRP, ~970,500 SOL, 18,270 BTC, total ~$6.34B, most within 20 minutes.
Why didn't suspending withdrawals stop it? The malicious EIP-7702 delegations were already on-chain, and the MPC wallet has no single private key to revoke — it needed a special procedure.
Who? TRM Labs and the FBI attribute it to North Korea's TraderTraitor (same group as the Bybit $1.5B theft); North Korea denies it. Binance says it found no evidence of a private key leak.
Now: ~$2.85B frozen/intercepted, Binance says ~98% replenished.
Note: This is based on Binance's Nov 3 preliminary report + TRM Labs/FBI findings; the full post-mortem and independent review are not out yet.
