Binance details how hackers drained $6.34bn from its wallets

Binance’s hot wallets, used to process transactions, were drained in a breach that exposed how employee access and wallet controls can put exchange-held crypto at risk. In a preliminary report published Nov. 3, the exchange said attackers used compromised employee devices and credentials to reach its wallet-signing systems and steal assets worth about $6.34 billion.

Binance said it had replenished 98% of the affected assets by Nov. 3 and was sourcing the less liquid remainder. The company says it will cover the loss, so customers are not being asked to absorb it. Its preliminary incident report says about $2.85 billion of the stolen assets had been frozen or intercepted, subject to reconciliation and changes in market prices.

How did the attackers get access to Binance’s wallets?

Binance’s account describes a months-long intrusion that culminated in unauthorized access to its wallet-signing service, which approves transactions. In June, the exchange says, an engineer downloaded a tampered version of Homebrew while installing an AI coding tool. Binance says it detected the anomaly and replaced the device, but the attackers learned about the engineer’s role and colleagues on the wallet team.

In a later step, Binance says, attackers used a fake job interview to persuade another software engineer to download a malicious code repository onto a work computer. The exchange says malware on that device helped attackers gain access to an internal AI tool and then to other employees’ systems. By Oct. 29, the attackers had used stolen credentials and a deployment token to run a malicious script that reached wallet operations.

Binance says five hot wallets sent 233.46 million XRP to an attacker-controlled address in four minutes. Other transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers also used Ethereum’s EIP-7702 authorization mechanism to grant a smart contract partial execution rights over a hot wallet. Binance says that on-chain authorization let some transfers continue independently of its usual withdrawal infrastructure, even after it suspended withdrawals.

Who does the FBI say was behind the theft?

The FBI attributed the theft to North Korea and identified the activity as TraderTraitor, a name it uses for North Korean cyber operations. The bureau said attackers were converting stolen assets primarily into ether and urged crypto services, including decentralized finance platforms and instant-swap providers, to block transactions tied to identified addresses. Binance’s report says its attribution follows the FBI’s findings.

Freezing assets depends on what was stolen and where it moves. Binance says it worked with partners to freeze or intercept about $2.85 billion. Reuters reported that stablecoin issuers can freeze tokens such as USDT and USDC, while bitcoin and ether have no central issuer that can block transfers. That means the recovery effort involves tracking assets and coordinating with exchanges and other services that may be able to stop or flag them.

How is Binance covering the loss, and what remains?

Binance says it reserved more than $6.34 billion in company funds to cover the impact. In an earlier recovery update, it said it was using a portion of its Secure Asset Fund for Users, a futures insurance fund and corporate treasury funds to replenish affected tokens. It said the remaining 10% at that point consisted of less liquid assets it planned to source through market and over-the-counter purchases.

The exchange says it rebuilt affected systems, replaced devices, disabled credentials and added tighter device controls and behavioral monitoring. It has also said independent cybersecurity firms will review the incident. The next measure to watch is whether Binance reaches 100% replenishment and what that review identifies about the weaknesses in its signing controls.

Sources

• preliminary incident report — binance.com