Binance Probe Traces Wallet Breach to Compromised Tools and Credentials

Binance’s preliminary investigation traced unauthorized access to its wallet-signing service to compromised developer tools and stolen deployment credentials, showing how an employee-device breach reached systems used to authorize fund transfers.

The attack chain began in June, when a wallet operations engineer downloaded a tampered Homebrew installer while looking for an AI coding tool. Binance’s security team detected abnormal activity, replaced the device and rotated credentials, but information about the engineer’s role and wallet infrastructure colleagues had already been exposed.

In September, a second engineer was targeted through a fake hiring process and induced to download a malicious code repository onto a work computer. Attackers later used that device and an internal AI tool to reach other engineers’ computers and locate a container deployment token. With credentials taken from one engineer, they deployed a container, ran malicious scripts and accessed the signing service.

Binance said the transfers bypassed its normal withdrawal process. On Ethereum, attackers used EIP-7702 to assign attacker-controlled code to affected hot wallets. Because those code delegations operated separately from ordinary withdrawals, pausing withdrawals alone could not stop the transfers; additional transactions were needed to revoke them.

AltLayer founder YQ called for isolating devices used for sensitive operations, logging privileged access and requiring multiple approvals. Binance Chinese community lead Sisi said Nov. 3 that the company had closed identified access points, rebuilt affected wallet systems and internal AI tools, replaced devices and revoked credentials. Sisi said Binance had hired an independent security firm and plans to publish its review findings.