Binance says North Korean hackers stole $6.34 billion funds in a technical breach

The company said it has frozen or intercepted approximately $2.85 billion of the affected assets and will cover the financial losses resulting from the October 29 attack.

In a detailed statement released on November 3, Binance said it had already set aside more than 100% of the funds required to compensate for the losses. As of October 31, the exchange had replenished 98% of the affected token assets, with the remaining purchases involving less liquid cryptocurrencies still underway.

The attack, potentially the largest cryptocurrency theft on record, involved unauthorised access to an internal wallet signing service that allowed hackers to transfer digital assets outside the exchange's normal withdrawal process.

According to Binance, five of its hot wallets transferred 233.46 million XRP to an attacker-controlled address within four minutes on October 29. Other wallets on the Solana and Optimism networks subsequently transferred approximately 970,500 SOL and 44.2 million OP tokens.

Hackers also transferred 18,270 Bitcoin from a Binance hot wallet.

The company said the attackers later exploited Ethereum's EIP-7702 authorisation mechanism, which allows cryptocurrency accounts to delegate certain transaction permissions to smart contracts.

By using this mechanism, the hackers obtained execution rights over a Binance wallet, allowing them to continue moving assets even after the exchange suspended withdrawals.

Binance said the attackers submitted 50 transactions to manipulate account permissions and establish malicious authorisations on the blockchain.

The exchange eventually revoked the permissions, but the process was complicated by its use of multi-party computation technology, which distributes control of wallet signing operations.

The final unauthorised transfer, involving 2,961.9 Ether, was completed at 23:56 UTC on October 29. Binance said it cleared the malicious delegation from the affected wallet shortly after midnight.

Fake job interviews opened the door

Binance's investigation found that the attack had been prepared over several months, beginning with attempts to compromise employees involved in the company's wallet infrastructure.

In June, a wallet DevOps engineer downloaded a tampered software installation package while attempting to install a popular artificial intelligence coding tool.

Although Binance's security team detected suspicious activity, replaced the device and rotated related credentials, the incident exposed information about the engineer and colleagues working on its wallet infrastructure.

The attackers returned in September, approaching another software engineer through a legitimate job-search platform.

An individual posing as a project director arranged interviews with people claiming to be a human resources representative and the chief executive of a fictitious company.

During the second interview, the engineer was instructed to download a coding assignment onto a work computer. The assignment contained malicious software that executed during setup and established communication with an external server controlled by the attackers.

According to Binance, the malware used advanced techniques to evade endpoint security systems, replacing a legitimate software development component with a malicious version.

On October 20, the attackers used the compromised computer and an internal AI tool to gain access to two other engineers involved in wallet operations.

They subsequently discovered a container deployment token on a DevOps engineer's computer.

On October 29, the attackers used the stolen credentials and another engineer's compromised device to deploy a container and execute a malicious script targeting Binance's wallet signing infrastructure.