Binance says North Korean hackers stole $6.34 billion funds in a technical breach

A hot wallet is generally a cryptocurrency wallet connected to the internet and used to send or receive assets. That connectivity makes transactions convenient, but it also means control of the wallet can be a high-value security risk. The article does not provide a formal definition, but it identifies Binance’s hot wallets as sources of the stolen funds.

Attackers gained access to an internal wallet signing service. Five Binance hot wallets then transferred 233.46 million XRP within four minutes. Other wallets moved about 970,500 SOL, 44.2 million OP tokens, and 18,270 Bitcoin. These transfers happened outside Binance’s normal withdrawal process.

The access mattered because the attackers could use Binance’s signing infrastructure to authorise blockchain transactions. Binance later revoked malicious permissions and froze or intercepted approximately $2.85 billion of affected assets. The company said it would cover the financial losses and had replenished 98% of affected tokens by October 31.

The scale was extraordinary. Binance said approximately $2.85 billion of affected assets had been frozen or intercepted, and described the attack as potentially the largest cryptocurrency theft on record. This figure refers to affected assets, while Binance separately said it would cover the resulting financial losses.

The attackers first moved 233.46 million XRP from five hot wallets within four minutes. Wallets on Solana and Optimism then transferred about 970,500 SOL and 44.2 million OP tokens. Hackers also transferred 18,270 Bitcoin from a Binance hot wallet.

Ether was moved later through the Ethereum authorisation mechanism. The final unauthorised transfer involved 2,961.9 Ether at 23:56 UTC on October 29. By October 31, Binance said it had replenished 98% of affected token assets, with purchases of less liquid cryptocurrencies still underway.

Normally, an exchange’s withdrawal process applies checks before assets leave its wallets. In this attack, unauthorised access to Binance’s internal wallet signing service allowed hackers to initiate blockchain transfers outside that ordinary route. That turned an internal security compromise into direct movement of customer-related assets.

The attackers used stolen credentials and a compromised engineer’s device to deploy a container and run a malicious script against the wallet signing infrastructure. Five hot wallets then transferred XRP, while wallets on Solana and Optimism moved SOL and OP tokens. Bitcoin was also transferred from a Binance hot wallet.

The attack continued through permissions on Ethereum. The hackers submitted 50 transactions to manipulate account permissions and establish malicious authorisations. Binance suspended withdrawals, but the attackers still had execution rights over one wallet until the exchange cleared the malicious delegation shortly after midnight on October 29.

The attackers spent several months targeting employees connected to Binance’s wallet infrastructure. In June, a DevOps engineer downloaded a tampered installation package while trying to install a popular artificial-intelligence coding tool. Binance detected suspicious activity, replaced the device, and rotated credentials, but information about the engineer and colleagues was exposed.

In September, another engineer was approached through a legitimate job-search platform. A person posing as a project director arranged interviews with people pretending to represent human resources and a fictitious company’s chief executive. During the second interview, the engineer downloaded a coding assignment onto a work computer. Malicious software ran during setup and contacted an attacker-controlled server.

The malware replaced a legitimate software-development component and evaded endpoint security systems. On October 20, the compromised computer and an internal AI tool helped reach two more engineers. The attackers then found a container deployment token and used compromised devices and credentials on October 29.

Ethereum’s EIP-7702 authorisation mechanism allows cryptocurrency accounts to delegate certain transaction permissions to smart contracts. In practical terms, that delegation can give another process defined authority to execute actions for an account. The article identifies this mechanism as the route that extended the attack.

After obtaining access to Binance’s wallet infrastructure, the hackers exploited EIP-7702 to gain execution rights over a Binance wallet. They submitted 50 transactions to manipulate account permissions and create malicious authorisations on the blockchain. Those permissions let them continue moving assets even after Binance suspended withdrawals.

Binance eventually revoked the malicious permissions. The exchange said clearing them was complicated by its multi-party computation system, which distributes control of wallet-signing operations. The final unauthorised transfer, 2,961.9 Ether, occurred at 23:56 UTC on October 29. Binance cleared the malicious delegation shortly after midnight.

The attack created a financial risk for Binance and affected customers because assets were transferred from exchange-controlled wallets. Binance said it would cover the resulting financial losses. It also said it had already reserved more than 100% of the funds needed for compensation.

The company reported freezing or intercepting approximately $2.85 billion in affected assets. It replenished 98% of the affected token assets by October 31. The transfers included XRP, SOL, OP, Bitcoin, and Ether, while purchases of less liquid cryptocurrencies were still underway.

Binance also worked to stop the technical access. It revoked the malicious blockchain permissions and cleared the affected wallet’s delegation shortly after midnight on October 29. The response was complicated by multi-party computation, which distributes control of signing operations. The company’s stated goal was to restore the affected assets and cover losses.

Cryptographic signing keys are powerful because they authorise blockchain transactions. Whoever can use the relevant signing system may be able to approve transfers from a wallet. Blockchain permissions are similarly important because they can grant execution rights over an account. The article does not explain the underlying cryptography in detail; these are established characteristics of blockchain systems.

In this attack, hackers used a wallet signing service to move assets outside Binance’s normal withdrawal process. On Ethereum, they exploited EIP-7702 to create malicious authorisations. Those permissions allowed continued asset movement even after withdrawals were suspended. Binance said the attackers submitted 50 transactions to manipulate permissions.

Multi-party computation distributes control of wallet-signing operations rather than placing it in one location. That can strengthen control, but it also complicated Binance’s effort to revoke the malicious permissions. The exchange eventually cleared the delegation and stopped the attackers’ access. The incident shows why both signing credentials and account permissions require careful protection.