Binance’s October Breach: What the Incident Report Reveals
Binance has published its first detailed account of the October 29 security breach that affected roughly $6.34 billion in digital assets. The report traces how attackers spent months working toward the exchange’s wallet infrastructure, and Binance highlighted it in a November 3 post on X.
The account follows the attack through compromised developer software, a fake recruitment process, malware on employee computers and abuse of an internal AI tool. The FBI has since attributed the operation to North Korea’s TraderTraitor campaign.
The attack started months before the theft
Binance says the first known stage appeared in June, when an engineer on its wallet DevOps team downloaded a tampered Homebrew installation while trying to install a popular AI coding tool. Binance’s security team detected the anomaly, replaced the computer and rotated associated credentials. The exchange says information about the engineer’s role and colleagues had already been exposed by then.
A second employee was targeted in September through what appeared to be a legitimate recruitment process. According to Binance, someone posing as a project director contacted the engineer through a job platform. The process included video interviews with people presenting themselves as an HR representative and the CEO of a fictitious company.
Near the end of one interview, the employee was asked to download a coding assignment. The repository contained malicious software that Binance says was not detected by its endpoint security tools at the time.
By October 20, the attackers were using that compromised computer and an internal Binance AI system to reach two other wallet engineers. On October 29, they used another employee’s workstation together with stolen credentials to deploy a container and trigger the attack.
How the funds left Binance
The unauthorized transfers began shortly after 20:05 UTC.
Binance says five hot wallets sent 233.46 million XRP to an attacker-controlled address in the first few minutes. Other wallets transferred about 970,500 SOL, 44.2 million OP and 18,270 BTC.
The Ethereum portion of the incident introduced an additional problem. The attacker used Binance’s signing service to create malicious EIP-7702 authorizations, which can delegate execution rights from an account to smart-contract code without revealing the private key.
Those permissions were already recorded on-chain, so shutting down Binance’s normal withdrawal system did not remove them. The affected hot wallet also used multi-party computation, leaving the response team without a single private key it could use to revoke the authorization. Binance says engineers had to create a specialized revocation procedure.
The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the malicious EIP-7702 delegation at 00:10 UTC on October 30 and says it observed no further unauthorized transfers afterward.
Who was responsible?
The FBI said on October 31 that North Korea was responsible for the theft and identified the activity as TraderTraitor, a name it uses for a North Korean cyber operation that has targeted cryptocurrency companies. The bureau said the stolen assets were being converted primarily into ether and could subsequently pass through decentralized finance platforms and instant-swap services.
North Korea has rejected the accusation.
The attribution fits a pattern in crypto theft: attackers go after the people and systems around wallets, not the cryptography itself. In Binance’s account, the decisive access came through developer machines, credentials and transaction-authorizing infrastructure.
Binance says users will not bear the loss
Binance says it will absorb the financial cost of the incident and has reserved more than enough company resources to cover the affected assets.
Binance co-founder Changpeng Zhao put the Tether and Circle freezes at about $971 million and $823 million. The exchange’s later total for frozen or intercepted assets was about $2.85 billion, though that figure remains subject to reconciliation and market-price changes.
By October 31, Binance said approximately 98% of the impacted token assets had been replenished. The rest was concentrated in less liquid assets.
The exchange took a new Proof of Reserves snapshot on October 31. It subsequently completed a zero-knowledge proof covering ten major assets, including BTC, ETH, USDT, BNB, SOL, USDC and XRP. Account holders can use the Merkle tree behind the snapshot to check that their balances were included, and the proof is meant to show those balances were backed at least 1:1.
Proof of Reserves gives users cryptographic evidence about a single moment. The PCAOB has warned that such reports are not equivalent to full financial-statement audits, and Binance’s own explainer notes that a snapshot does not account for off-chain liabilities. Neither addresses an exchange’s overall solvency or the quality of its controls.
Withdrawals are returning, but confidence is being tested
Binance suspended withdrawals while it investigated and rebuilt affected systems. Selected networks began reopening on November 1, and another group of assets entered a phased reopening on November 3. Deposits stayed available throughout.
Large sums left the exchange as soon as withdrawals returned. CoinDesk reported that customers had pulled $3.6 billion by November 2, and Binance’s own tally put withdrawals at $10.97 billion against $5.695 billion in deposits between 06:00 UTC on November 1 and 04:00 UTC on November 3, a net outflow of about $5.28 billion. By early November 3, hourly deposits had moved above withdrawals.
Bitcoin fell to a six-week low in the immediate aftermath, and ether dropped more than 3%. OKX founder Star Xu called for delays or extra checks on unusually large transfers to unfamiliar addresses, real-time incident alerts and faster coordination between exchanges and token issuers. Other exchanges said they were reviewing or adjusting their own defenses.
Binance says it has rebuilt the affected wallet environment and internal AI tool, replaced compromised devices, revoked associated credentials, strengthened behavioral monitoring and wallet-risk controls, and hired independent cybersecurity experts to review the incident.
For users, the next useful evidence will come from those independent findings, further reserve snapshots and the continued restoration of withdrawals. The published details explain how the attackers got in. The public account does not yet show that the same route would fail today.
Sources
Binance’s November 3 post on X
Binance: security incident update, October 30
Binance: Recovery Update #5, October 31 Proof of Reserves snapshot
Binance: withdrawals restored in phases, November 1
Changpeng Zhao’s post on X
FBI: North Korea responsible for the Binance attack
Reuters: Tether and Circle freeze $238 million after the incident
Reuters: Binance says it has covered $6 billion of the $6.3 billion stolen
Reuters: withdrawals to resume after recovering the bulk of the funds
Reuters: crypto exchanges call for quick moves to bolster defenses
CoinDesk: Binance opens withdrawals in phases
CoinDesk: customers pull $3.6 billion after withdrawals reopen
TRM Labs: North Korea steals $6.36 billion from Binance
Elliptic: North Korea likely behind the Binance hack
crypto.news: Binance completes the reserve proof for ten tokens
The Hacker News: FBI links TraderTraitor to the theft