The $6.3 billion crypto heist: Binance explains how hackers breached its security systems

Binance, the world's largest cryptocurrency exchange, has revealed how hackers stole approximately $6.34 billion in digital assets in a sophisticated cyberattack on October 29, exploiting an internal wallet-signing service to move funds across multiple blockchain networks. The exchange managed to freeze or intercept around $3 billion of the affected assets, but questions have emerged over how attackers gained access to its internal systems.

“This is a highly complex attack. There are many different angles and a combination of technologies involved,” Binance APAC Head SB Seker told Fortune India.

“There were no breaches of private keys. It was not a key or algorithmic breach. A developer's laptop was compromised, which led to a service container compromise and subsequently to a hot wallet compromise,” he said.

In an initial incident report released on November 3, Binance detailed the attack and said it would bear the financial impact of the stolen funds rather than pass the losses on to users.

Seker said the exchange had frozen or locked around $3 billion worth of assets in coordination with global law enforcement agencies and ecosystem partners, including Circle and Tether. “The company would bear the full loss of any unrecoverable assets,” he said.

How the attack unfolded

According to Binance, attackers exploited unauthorised access to an internal wallet-signing service to initiate transactions outside the exchange's normal withdrawal process.

Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address. The exchange's wallets also transferred approximately 970,500 Solana (SOL) tokens and 44.2 million Optimism (OP) tokens to addresses controlled by the hackers. Another hot wallet sent 18,270 Bitcoin (BTC).

The attackers then exploited Ethereum's EIP-7702 authorisation mechanism, which allows an account to delegate certain execution rights to a smart contract without exposing its private key. This gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet, enabling further transfers outside the exchange's normal withdrawal infrastructure.

Binance suspended withdrawals, coordinated with partners to freeze affected tokens and began revoking unauthorised permissions. However, suspending withdrawals alone could not stop the outflows because the malicious authorisations were already active on the blockchain.

The affected hot wallet used Multi-Party Computation (MPC), meaning there was no single private key that could immediately revoke the permissions. Binance had to develop a specialised procedure to clear them. The final unauthorised transfer, involving 2,961.9 Ether (ETH), was completed at 23:56 UTC on October 29. No further unauthorised transfers were detected after that.

Binance said information released by the Federal Bureau of Investigation (FBI) alleged that North Korea was responsible for the incident. However, North Korea rejected the allegations, describing the FBI's findings as a "grave political provocation" and a "sinister attempt" by the United States to damage the country's public image.

Attack preparation began months earlier

Binance's investigation traced the campaign to June 2026, when an engineer in its Wallet DevOps team downloaded a tampered Homebrew installation while attempting to install an artificial intelligence (AI) coding tool. Although the exchange detected the anomaly, replaced the device and rotated credentials, the attacker had gained exposure to the engineer's role and colleagues.

In September, another software engineer was approached through a job-hunting platform by an individual posing as a project director. After two rounds of interviews, the engineer was asked to download an assignment containing a malicious code repository onto his work computer. The malware executed during installation and evaded endpoint security tools.

On October 20, the attacker used the compromised computer and an internal AI tool to gain access to other employees. On October 29, stolen credentials were used to access another engineer's computer, deploy a container and trigger the malicious script.

As of October 31, 98% of the affected token assets had been replenished. The exchange said it was purchasing the remaining, less liquid assets. It has rebuilt the affected wallet system, replaced compromised devices, decommissioned related credentials and strengthened wallet-service controls and AI-based behavioural anomaly detection. Independent cybersecurity firms are also being engaged to review the incident.

Social media users question security practices

Binance's explanation has triggered questions on social media over how a compromised developer laptop could ultimately expose the exchange's hot wallet infrastructure.

One user questioned the company's software installation protocols, saying: “The fact you allow your Engineers to downloads software and install software from random sites on company devices is shocking. Surely software should have to be approved from a secure download site/folder location?? Absolutely rookie stuff here.”

Another user questioned the use of laptops for sensitive engineering work and called for tighter restrictions on software installations.

“This is crazy. I think that a good approach here would be to mandate that all work is done in the office on desktop computer that are only for work. Letting engineers use laptops that can be taken anywhere is crazy. Also then some firewall on what pkgs can be installed should be in place.”

A third user questioned how a single compromised device could lead to such a large-scale breach and whether Binance's existing security systems were adequate.

“A few things I don't understand: How one compromised laptop can trigger such a hack? Because for highly sophisticated it seems quite simple. Follow the second question how did you not get hack before if you have such a security?”