Binance published its initial report on how attackers took about $6.34 billion in digital assets on Oct. 29, saying the intrusion began in June with a tampered software install and ran through a fake job interview in September.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

From Fake Recruiter to Stolen Token

According to Binance, a wallet DevOps engineer downloaded a tampered Homebrew installation in June while searching for an AI coding tool. Binance spotted the compromise, gave him a new machine and reset his credentials, but the engineer and colleagues on the wallet infrastructure team had already been exposed to the attacker, Binance said.

In September, a second engineer was approached on a job-hunting platform by someone posing as a project director, the exchange said. A live video interview with a purported HR representative came first. A second round, held in a social chat app with someone claiming to run a fictitious company, closed by telling him to fetch an “assignment” to his employer-issued computer. The repository behind it was malware. Binance said the zero-day malware went undetected by its endpoint tools at the time.

On Oct. 20, Binance said, the attacker used that engineer’s computer and an internal AI tool to take control of the first engineer and a third, then found a container deployment token on the first engineer’s machine. On Oct. 29, the attacker used the stolen credentials to log onto the third engineer’s computer, deploy a container and run a malicious script.

How the Money Moved

Binance said five hot wallets moved 233.46 million XRP to an address held by the attacker between 20:05 and 20:09 UTC, and Solana and Optimism hot wallets lost roughly 970,500 SOL and 44.2 million OP. A hot wallet then sent 18,270 BTC. The attacker next used the internal signing service to exploit EIP-7702, an Ethereum feature that lets a wallet hand some of its transaction powers to a contract, and gave a contract it controlled partial rights over a hot wallet, using 50 signing transactions.

Because the wallet used multi-party computation, no single private key could revoke those delegations, Binance said, so the team built a specialized procedure that took additional time. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the delegation at 00:10 UTC on Oct. 30.

Cleanup and Coverage

Binance said it rebuilt the affected wallet system and internal AI tool, replaced devices and decommissioned credentials tied to the engineers involved. It plans an independent third-party review and a security research fund, and said some technical details will stay confidential.

The exchange said that 98% of impacted token assets had been replenished as of Oct. 31. Its own recovery updates gave lower figures: 90% on Oct. 31 and about 95% on Nov. 2.

Related Listen: Why a Nation State Will Always Beat the Security of a DeFi Team