The attackers infiltrated Binance’s internal systems after months of preparation and withdrew assets from several exchange wallets. Binance later restored some withdrawals, while U.S. authorities attributed the attack to North Korea’s TraderTraitor group, an allegation Pyongyang rejected.

Months of preparation

According to Binance’s preliminary report on Nov. 3, preparations began at least several months before the theft. An initial investigation published Oct. 30 said a DevOps engineer’s laptop may have been compromised, although Binance said “further review uncovered additional points of entry.”

Binance said a Wallet DevOps employee downloaded a fake Homebrew installer in June while trying to install an artificial-intelligence coding tool. The company replaced the device and updated credentials, but said the attackers had already obtained information about the employee and colleagues.

In September, attackers posing as employees of a fictitious company persuaded another developer, during a fake job interview, to download a malware-infected code repository. Binance said the malware replaced a pyenv component and evaded its security tools.

On Oct. 20, the attackers used that computer and an internal Binance AI tool to access two more employees’ systems. They found a token carrying container-deployment permissions and used it on Oct. 29 to deploy a malicious container, according to Binance’s preliminary findings. The company said this provided unauthorized access to an internal transaction-signing service.

The theft

Blockaid said preparatory on-chain activity began on Oct. 28, when the operator’s wallet received three small transfers through Tornado Cash. The attacker later tested wallet delegation and deployed a smart contract with a sweep function.

TRM Labs said the first withdrawals on Oct. 29 went through the XRP Ledger before spreading to other blockchains. On Ethereum, the attacker submitted 50 EIP-7702 authorizations for the Binance 14 hot wallet, covering nonce values from 18,914,775 to 18,914,824. One matched the wallet’s current value.

The attacker then used the sweep function to remove about $2.5 billion from Binance 14 in one transaction, including 167,464 ETH and $1.615 billion in USDT. Twenty-four seconds later, 28,005 ETH left Binance 16. Withdrawals subsequently spread to the Optimism, Arbitrum and Avalanche networks.

Because the EIP-7702 delegation remained active, the attacker continued taking more than $1 billion in incoming USDC and USDT from Binance 14 over the following hours. Binance said suspending withdrawals did not revoke permissions already recorded on-chain. Its multi-party computation wallet architecture also lacked a single private key that could immediately cancel the delegation.

The final unauthorized transfer, involving 2,961.9 ETH, was confirmed at 23:56 UTC on Oct. 29. At 00:10 UTC on Oct. 30, Binance authorized the zero address for Binance 14, clearing the delegation. Withdrawals from Bitcoin, XRP Ledger, Tron, Solana and other networks used regular signed transactions rather than EIP-7702, a pattern TRM Labs said indicated compromised transaction-signing infrastructure.

Asset movements and response

TRM Labs said the attacker exchanged about 325 million USDT through UniswapX and other services for roughly 122,300 ETH. Another 60 million USDT was deposited as collateral with Aave in exchange for about 19,760 ETH, then worth $44.6 million. Aave temporarily froze hundreds of V3 and V4 lending reserves across several blockchains.

Binance suspended deposits and withdrawals and contacted law enforcement, stablecoin issuers and blockchain analytics companies. On-chain analyst ZachXBT estimated that industry participants froze about $2.8 billion, while Blockaid said Tether and Circle froze about $1.8 billion at the main collection address. Binance later put the frozen total at $3 billion.

Binance said it would use its resources and the SAFU insurance fund to cover confirmed user losses. It set aside more than $6.34 billion, including about $5 billion already held in the affected tokens, and bought remaining assets through market and over-the-counter channels.

Attribution and recovery

Binance reopened withdrawals for some Ethereum and BNB Smart Chain assets on Nov. 1 and said other networks would follow after security checks. It confirmed user funds through its proof-of-reserves system as of Oct. 31.

The FBI attributed the attack to North Korea’s TraderTraitor group and published Ethereum addresses linked to the stolen assets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the finding as a political provocation.

By Nov. 3, Binance said it had migrated the affected wallet system, rebuilt its internal AI and access-management systems, replaced compromised devices and revoked associated credentials. It also said its security team had detected and prevented 57 suspected North Korea-linked cyberthreats during 2026. Binance plans an independent review but said some technical details would remain undisclosed to avoid assisting potential attackers.

Source: Incrypted