Binance has traced a record-breaking $6.3 billion hack to a sophisticated cyberattack that exploited both human vulnerabilities and internal security systems. The attack, which unfolded over months, began in June when an engineer downloaded a tampered software package while setting up an AI coding tool. Although Binance detected and addressed the initial malware, the attackers had already gathered critical information about the exchange’s wallet team.
In September, hackers posing as recruiters targeted another software engineer, tricking the employee into downloading a malicious file disguised as a coding assignment. This compromise allowed the attackers to evade Binance’s security protections and gain access to the engineer’s work computer. On October 20, they used the compromised system and an internal AI tool to infiltrate two additional engineers’ systems, ultimately obtaining deployment credentials that facilitated the theft on October 29.
The attackers exploited Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts, enabling unauthorized transfers even after Binance suspended withdrawals. The exchange’s multiparty computation (MPC) wallet system, designed to distribute control over transaction signing, complicated efforts to revoke those permissions. As of October 31, Binance had replenished 98% of the affected token assets and absorbed the losses rather than passing them on to customers.
The Federal Bureau of Investigation (FBI) has attributed the attack to North Korean hackers, a claim denied by Kim Yo Jong, the sister of North Korean leader Kim Jong Un. She dismissed the FBI’s attribution as politically motivated, intended to damage North Korea’s international standing.