Binance Traces Oct. 29 Theft to Compromised Engineer Computers

Binance’s preliminary investigation traces the Oct. 29 wallet theft to a months-long intrusion that compromised engineers’ computers and gave attackers unauthorized access to the exchange’s internal wallet-signing service.

In June, wallet operations engineer A downloaded a tampered Homebrew installer while setting up an AI coding tool. Binance’s security team detected unusual activity, replaced the device and rotated credentials, but the attackers had already learned about A’s role and colleagues.

In September, software engineer B was tricked during a fake job interview into downloading a code repository containing malicious software, compromising B’s work computer. By Oct. 20, attackers were using that computer and internal AI tools to gain control of A and engineer C. They also found a container deployment token on A’s device.

On Oct. 29, attackers accessed C’s computer, used credentials stolen from A to deploy a container and ran malicious scripts. They then used unauthorized access to the internal wallet-signing service to transfer assets.

The timeline spans from a compromised software download in June to asset transfers on Oct. 29.