Binance has released an initial investigation report into the $6.34 billion virtual asset takeover accident. The new key point this time is that the attacker did not break through the wallet at once, but instead phased out the employee's devices and access rights over many months.
Downloads of tampered development tools in June, fake job interviews in September, and exploitation of internal AI tools in October have led to a single attack stream, according to the report. The attacker, who finally gained access to the wallet transaction signing system, moved several types of virtual assets unauthorized on October 29.
Unlike the scale of damage identified in previous reports and the indication behind investigative agencies, this announcement is meaningful as a follow-up investigation that describes the actual intrusion process and the point of defensive failure. However, the content disclosed by Binance is the result of an initial investigation that has not yet completed an independent review.
| Starting point for months of attacks
In June, a member of the wallet development and operations team downloaded a software installation tool that was tampered with during the search process. After detecting the anomaly, Binance replaced the device and updated the relevant authentication information, but it is possible that the attacker was given the opportunity to understand the work environment and some employee information inside the organization.
The danger of this example is not just a file download mistake. Even the install tools and search ads that developers use on a daily basis can be a conduit for supply chain attacks. That's why it's important to follow up with the attacker to see if any other touchpoints remain after the security measures.
| Account Breach Using Fake Job Interviews
In September, another software engineer interviewed a recruiter for a fake company. The attacker used real job search platforms, video calls, and virtual executive interviews to build trust and then induce them to download technical tasks. The task was a repository containing malware.
The company explained that the malware was executed in a way that changed the normal components of the development tools and avoided detection of terminal security products at the time. It means that the code you receive during recruitment or external collaboration can also be a channel to access the production system. In particular, external projects running on a work computer may not be enough to check the source.
| New attack point for internal AI tools
On October 20, the attacker allegedly used the breached employee's computer and Binance's internal AI tools to access the systems of other wallet employees. Afterwards, I found a token with permission to distribute the container, and this permission became the link for the final attack.
The important thing here is that AI itself does not mean that assets have been stolen independently. An attacker exploited an internal AI tool as an additional intrusion route based on previously hijacked devices and privileges. Even when operating enterprise AI tools, the scope of access, authentication tokens, and usage records of connected systems need to be managed as a separate security perimeter.
| Wallet signing service access and asset movement
On October 29, the attacker deployed a container using the credentials stolen from another engineer's computer and executed a malicious script. The key is that Binance's internal wallet signing service was abused to authorize transactions outside the normal withdrawal process.
Between 8:05 pm and 9:00 pm UTC, between four minutes, 233.46 million XRP moved from five hot wallets connected to the Internet. Since then, other blockchain assets have been unauthorized. This number does not mean that the entire amount of damage was caused by XRP alone, but it is the amount of movement in one section that was confirmed in the entire attack.
| Damage after withdrawal was suspended
Binance detected abnormal large-scale transfers and pushed for withdrawal suspensions and asset freezes. However, the delegation of authority on the blockchain already created by the attacker was not automatically lifted even if the exchange's general withdrawal system was stopped. The last unauthorized transfer was confirmed at 23:56 UTC on October 29th.
The report explains that Ethereum's EIP-7702 delegation of authority and multilateral computation-based wallet structure required additional steps to revoke privileges. Technically, it means that blocking online services and deauthorizing on-chain are different tasks. If both steps are not included in the emergency response plan, the damage blocking may be delayed.
| Distinguish between damage repair and behind the attack
Binance explained that the assets involved in the accident are worth about $6.34 billion, and about $2.85 billion has been frozen or blocked from movement. The company announced that it would replenish the affected assets on its own, stating that some of the assets had already been covered. However, the frozen amount, recovered amount, and conservation funds arranged separately by the company are not the same concept.
The FBI has identified a North Korea-related hacking organization as the one behind it. This is the official judgment of the investigative agency, but the initial technical report alone cannot say that all responsibilities and the identity of individual attackers have been finalized. Binance also said it would conduct additional independent reviews from outside experts.
| Challenges to improve development environment and rights management
Binance explained that it has rebuilt the affected wallet system and internal AI tools in a new environment, replaced related devices, and disabled employee credentials and tokens. AI-based abnormal behavior detection and wallet risk control have also been strengthened, but the actual effect of these measures should see the results of subsequent verification.
At the organizational level, it seems important to handle external code execution in a separate development environment, minimize distribution rights, and check long-lasting tokens. In particular, it should be possible to distinguish between the development tasks that a person performs as a normal procedure and commands using the session that the attacker hijacked. This incident shows that human security and system rights management can lead to one problem.
| What the initial report means and future validation
The value of this follow-up news is not in repeating the damages. The attack was prepared from June, and it was revealed that a specific trend led to a wallet signature service through job interviews and internal AI tools. It has also been revealed that there is a direct link between the problem of protecting user assets and the design of access rights within the development organization.
In the future, as a result of external security investigations, it is necessary to check the exact size of on-chain asset recovery and whether the delegation authority withdrawal system has been improved. Binance's explanation provides technical clues, but it is not yet the final independent verification report. You have to maintain this distinction so that you don't exaggerate the case or assume unidentified responsibility.
References
Binance — Security Incident: Preliminary Investigation Findings and Response Progress Reuters — Binance hackers used fake job interview in $6.3 billion attack Binance — Security Incident Update (2026-10-30)
Tags
# Binance # hacking # cybersecurity # virtual assets # supply chain attacks # social engineering # fake job interviews # AI security # access rights # hot wallet # EIP7702 # infringement
