Overview
- The theft, which occurred on Thursday, Oct. 29, moved about $6.3 billion from Binance hot wallets over roughly 20 minutes and in follow‑on transfers.
- Investigators say attackers ran a months‑long campaign that included a tampered Homebrew installer in June and fake job interviews and coding tests in September to compromise engineers’ work devices.
- Attackers gained access to Binance’s internal wallet‑signing service and exploited Ethereum’s EIP‑7702 permissions and aspects of the exchange’s multiparty computation signing setup, allowing transfers to continue after withdrawals were paused.
- Binance says it rebuilt affected wallet systems, rotated credentials, completed enhanced device scans, restored some withdrawals and replenished about 98% of affected assets while partners helped freeze roughly $2.85–3.0 billion of the flow.
- The FBI attributed the theft to the North Korea‑linked TraderTraitor unit and Pyongyang denied involvement, while critics including CoinEx founder Haipo Yang faulted Binance’s environment separation and signer verification and the company pledged independent cybersecurity reviews.