THE ESSENTIALS IN 30 SECONDS

  • Binance estimates about $6.34 billion in digital assets were affected and says roughly $2.85 billion has been frozen or intercepted.
  • The attackers moved from a compromised engineer's computer to two colleagues' accounts through an internal AI tool, which Binance has since rebuilt.
  • The FBI attributed the theft to North Korea's TraderTraitor operation; Binance says it will cover the losses itself.

Binance published its initial findings on November 3 about the October 29 attack on its hot wallets, which it says affected approximately $6.34 billion in digital assets. The report describes a campaign that unfolded over several months and relied less on a single software flaw than on the people, devices and internal tools around the exchange's wallet team.

A four-month path to the wallets

According to Binance, the groundwork began in June, when an engineer on the Wallet DevOps team installed a tampered Homebrew package. The National reports he was trying to install a popular AI coding tool found through a search engine. Binance replaced the device and rotated credentials, but says the incident exposed the engineer's role and the names of his wallet colleagues.

In September, a second engineer was approached on a legitimate job platform by someone posing as a project director. The Hacker News describes two interview rounds with a fictitious company, ending with a coding "assignment" whose repository swapped a development tool component for a malicious one. Running it on his work computer gave the attackers a foothold.

On October 20, Binance says, the attackers used that machine and an internal AI tool to gain control of two more engineers' accounts, one of which held a token allowing container deployments. On October 29, they used it to deploy a container, run a malicious script and reach an internal signing service, sending XRP, SOL, OP, BTC and ETH out of hot wallets over several hours.

Why the AI tool matters

Binance does not explain how the internal AI tool was abused and says some technical details will remain confidential. Even so, its account places the tool at the step where the intrusion spread from one compromised laptop to the accounts that held deployment rights. Assistants and agents deployed inside companies often run with employees' credentials and broad access to code and infrastructure, which can make them a useful pivot for anyone who controls one user's machine. Among its fixes, Binance says it rebuilt the AI tool together with its access controls and added AI-based behavioural anomaly detection.

Attribution and losses

The FBI has linked the theft to TraderTraitor, a North Korean operation, and said the hackers were mainly converting the assets into ether, according to The Korea Times. Chainalysis ties more than $14.3 million in losses over 18 months to similar fake-interview schemes. Binance says about $2.85 billion has been frozen or intercepted, that it will absorb the loss rather than its users, and that 98% of affected token assets had been replenished by October 31. Its investigation is ongoing.