This article was compiled and organized by BlockWeeks
Binance has released its first investigation report on the approximately $6.34 billion digital asset outflow incident on October 29. The report reconstructs an attack chain spanning four months: the entry point was a tampered software installation in June, while the key breakthrough was a carefully designed fake job interview in September.
June: A "AI Programming Tool" Download Planted the Seeds
According to Binance, a wallet DevOps engineer downloaded a tampered Homebrew installation package in June while searching for a certain AI programming tool. Binance subsequently discovered signs of compromise on that machine, replaced the engineer's device, and reset credentials. However, the exchange acknowledged that this engineer, along with other colleagues on the wallet infrastructure team, had already been exposed to the attackers' view by this time.
September: A Recruiter Posing as a "Project Director"
In September, a second engineer was contacted on a job platform by someone claiming to be a "project director." The person first arranged a video interview with a supposed HR representative, then moved the second round to a social chat app, where the contact claimed to run a company that did not exist, and finally asked the engineer to pull a "assignment" onto the company-issued computer—that code repository itself was malware.
Binance stated that this zero-day malware was not detected by its endpoint security tools at the time.
October 20: Internal AI Tools Became a Springboard
Binance stated that on October 20, the attackers used the second engineer's computer and a set of internal AI tools to gain control of the accounts of the first and third engineers, and found a container deployment token on the first engineer's machine.
October 29: Five Hot Wallets Drained in Four Minutes
On October 29, the attackers used stolen credentials to log into the third engineer's computer, deploy containers, and run malicious scripts.
Binance disclosed that between 20:05 and 20:09 UTC, five hot wallets transferred 233.46 million XRP to addresses controlled by the attackers; the Solana and Optimism hot wallets lost approximately 970,500 SOL and 44.2 million OP respectively. Subsequently, one hot wallet transferred out another 18,270 BTC.
Next, the attackers used an internal signing service and leveraged the Ethereum EIP-7702 feature (which allows a wallet to delegate certain transaction permissions to a contract) to grant a contract controlled by the attackers partial permissions over a hot wallet through 50 signed transactions.
MPC Saved the Day, but the Stop-Loss Was Half a Beat Late
Because the wallet used a multi-party computation (MPC) architecture, no single private key could revoke these delegations, so the Binance team had to build a dedicated remediation process on the fly, which lengthened the time required. The last unauthorized transfer was 2,961.9 ETH, which completed final confirmation at 23:56 UTC; Binance did not clear the relevant delegations until 00:10 on October 30.
Rebuilding, Auditing, and Compensation Approach
Binance stated that it has rebuilt the affected wallet systems and internal AI tools, replaced the relevant devices, and disabled the credentials under the names of the engineers involved. The exchange also plans to bring in an independent third-party review and establish a security research fund, while stating that some technical details will remain confidential.
Regarding asset compensation, Binance stated that as of October 31, 98% of the affected token assets had been replenished. However, the figures in its own recovery progress updates were lower: 90% on October 31 and approximately 95% on November 2.
