Binance has detailed a complex cyberattack that resulted in the theft of approximately $6.34 billion in digital assets on October 29. The attackers employed a multi-stage strategy, combining fake recruitment interviews, malware, and a compromised internal AI tool to breach the exchange's systems. The campaign began in September when an engineer was targeted through a job-hunting platform, leading to the download of malicious software onto a work computer. This malware evaded detection and established communication with an external server controlled by the attackers.
By October 20, the attackers had leveraged the compromised computer and an internal AI tool to gain access to other employees, obtaining credentials linked to wallet infrastructure. On October 29, they exploited unauthorized access to Binance’s internal wallet signing service to initiate unauthorized transactions. As of the latest update, around $2.85 billion of the stolen funds had been frozen or intercepted, subject to reconciliation and market price movements.
Binance has taken steps to mitigate the damage, including rebuilding the affected wallet system and internal AI tool, replacing compromised devices, and strengthening wallet-service controls. The exchange has also set aside more than 100 percent of the funds required to cover the losses, with 98 percent of the affected token assets replenished as of October 31. The company emphasized that it would absorb the financial impact of the stolen funds, not its users.
The Federal Bureau of Investigation (FBI) has attributed the attack to North Korea, identifying it as the ‘TraderTraitor’ operation. The FBI urged exchanges and other virtual asset service providers to block transactions linked to the stolen funds. Binance’s investigation remains ongoing, with findings subject to further independent review.