Binance has released new details about the $6.3 billion cryptocurrency theft in October, outlining how attackers infiltrated the exchange using a combination of social engineering and sophisticated malware.
Attack traced to social engineering and tampered software
The incident began in June when a Binance wallet developer downloaded a software tool containing hidden malware. An individual familiar with the matter explained that hackers had embedded the malicious version within an online advertisement, causing it to rank higher in search results than the genuine tool.
Subsequently, another Binance engineer fell victim to a fake job interview and downloaded a compromised code repository in September. The engineer believed the offer was legitimate and even participated in a virtual meeting with someone claiming to be the CEO of a fictitious company.
Michael Barnhart, a researcher at cybersecurity group DTEX, described such job interview scams as a common tactic among cybercriminals seeking access to organizations’ critical systems.
The initial compromise went undetected. Although Binance later replaced the affected device and altered internal credentials, roles and access privileges among wallet development team members remained exposed, allowing the staged attack to progress over several months.
Mini dictionary: DTEX, a cybersecurity company specializing in insider threat detection and behavioral analytics for enterprises.
Rapid theft executed from compromised wallets
On October 20, the attacker leveraged the compromised computer and internal AI tools to gain further control over the systems belonging to two wallet developers. Nine days later, using credentials stolen from the first developer, the attacker activated a malicious script from the second engineer’s computer.
In the early hours of October 29, the perpetrator drained 233.46 million XRP from five Binance hot wallets, transferring the funds to an external address in less than four minutes. Additional cryptocurrencies, including bitcoin, were withdrawn in subsequent actions.
According to an informed source, only a select group of Binance engineers have direct wallet access. The attackers manipulated 50 signing transactions in a coordinated effort to bypass internal controls.
| Asset | Volume Stolen | Timeframe |
|---|---|---|
| XRP | 233.46 million | 4 minutes |
| Other cryptocurrencies (incl. bitcoin) | Undisclosed | Following initial theft |
Binance reported that attackers used these signing transactions to transfer assets swiftly across multiple wallets.
Binance response and strengthened safeguards
After receiving an internal alert regarding large outbound transfers, Binance immediately began an investigation, suspended withdrawals, froze the implicated tokens, and removed unauthorized permissions. These emergency measures resulted in approximately $2.85 billion worth of assets being frozen.
Despite this, unauthorized withdrawals continued for nearly four hours after the breach began, due to the time required for Binance to create and deploy new procedures for revoking account authorizations.
In the aftermath, Binance publicly apologized to its users, partners, and the broader crypto industry. The company announced that all affected customers would be reimbursed in full.
Binance stated in its official report, “This should not have happened,” and committed to redoubling efforts to combat cyber attacks through advanced security measures.
The exchange revealed that it had already detected and prevented 57 suspected North Korean-linked cyber threats in 2026. Industry experts characterized Binance as being under continuous attack amid growing threats against cryptocurrency infrastructure.
To further strengthen security, Binance reported increased investments in AI-driven detection systems and launched a security research fund. The company is collaborating with leading AI firms to enhance its protection against evolving threats.
