Binance Traces Wallet Breach to Compromised Computer, Internal AI Tool

Binance said an attacker used a compromised engineer’s computer and an internal AI tool to reach wallet operations in a breach that affected about $6.34 billion in digital assets.

The exchange’s initial findings, published Tuesday, Nov. 3, trace the intrusion to a fake recruitment process in September. An engineer downloaded a malicious coding assignment onto a work computer. On Oct. 20, the attacker used that computer and Binance’s internal AI tool to access two other engineers, one of whom had a container deployment permission token.

On Oct. 29, the attacker used stolen credentials to access another engineer’s computer, deploy a container and run a malicious script between 1:15 and 3:56 p.m. ET (17:15 to 19:56 UTC). Binance put frozen or intercepted funds at about $2.85 billion as of Nov. 3; the figures are subject to reconciliation and market-price changes. The exchange said 98% of affected token assets had been replenished as of Oct. 31.

Binance said 50 signing transactions established malicious Ethereum EIP-7702 authorizations, which let accounts delegate execution to smart contracts without exposing private keys. The exchange said the authorizations could move assets outside its normal withdrawal system. Its investigation is ongoing, and the initial findings are subject to independent review.