Binance's initial report on the $6.34B Oct 29 theft: a fake job interview, a tampered pyenv, an internal AI tool used to reach wallet engineers, then EIP-7702 delegations that kept draining after withdrawals stopped
- Earlier exposure: in June a Wallet DevOps engineer installed a tampered Homebrew package while searching for a popular AI coding tool. Binance replaced the device and rotated credentials, but says the team's roles were exposed to the attacker. Binance blocked 57 suspected North Korea-linked attempts in 2026.
- Theft (UTC, Oct 29): 233.46M XRP from five hot wallets between 20:05 and 20:09, then about 970,500 SOL, 44.2M OP and 18,270 BTC. The final transfer, 2,961.9 ETH, settled at 23:56.
- Why containment was slow: the attacker used the signing service to sign about 50 transactions setting up EIP-7702 delegations to an attacker contract. Those kept working on-chain after Binance halted withdrawals, and because the wallet used multi-party computation (MPC) there was no single key to revoke them quickly. The delegation was cleared at 00:10 UTC on Oct 30.
- Impact: about $6.34B affected, about $2.85B frozen or intercepted; Binance says it is covering losses and had replenished 98% of affected token assets by Oct 31.
Lessons for everyone, not just exchanges: (1) Take-home coding tests are a delivery channel; they belong in a disposable VM, never on a work laptop. (2) Internal AI tools that can act across colleagues' machines or accounts are lateral-movement infrastructure; scope and log them like admin tools. (3) Deployment tokens on developer laptops are crown jewels. (4) If you run EVM hot wallets, your playbook needs a tested way to revoke EIP-7702 delegations, because pausing withdrawals won't do it.
Sources: Binance on X: 29 October Binance Security Incident: Initial Findings and Response Update (Nov 3) · FBI: North Korea responsible for $6 billion Binance attack · The Record: Binance CEO says 'months-long campaign' led to $6.3 billion theft