THE CRUNCH
Binance has published its first incident report on the record-breaking $6.34bn theft from its hot wallets on 29 October, revealing a months-long campaign rather than a single breach. The FBI has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group linked to Lazarus Group. Pyongyang has rejected the accusation, with Kim Yo-jong calling the US claims "absurd rhetoric".
The intrusion began in June, when a wallet infrastructure engineer downloaded a tampered Homebrew installation, a package manager for macOS, after searching for a popular AI coding tool via a search engine. Binance's security team detected the malware, replaced the device and rotated credentials, but the attackers had already learned the engineer's role and identified colleagues on the wallet team.
In September, a second engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. After a video interview with a fake HR representative who shared a social media account to build trust, and a chat-app interview with a purported CEO, the engineer downloaded a coding "assignment" that was actually malware. It replaced a legitimate development tool component with a malicious version, and Binance says its endpoint security tools did not detect this second infection.
On 20 October, the attackers used the compromised computer and an internal AI tool to take control of two wallet engineers' machines. On 29 October they used stolen credentials and a container deployment token to reach Binance's internal wallet signing service and trigger the theft. Binance says $2.85bn of the stolen assets has been frozen or intercepted, and that it will absorb the losses, with 98% of affected tokens already replenished and withdrawals broadly resumed. When the theft was first disclosed on 30 October, Binance's co-founder Yi He pledged the company would cover "all hacking losses", with about $3bn located at that stage; the incident report now puts frozen or intercepted assets at $2.85bn.