Binance says the hackers behind its $6.3 billion theft worked their way in through employee computers, using a fake recruitment process and an internal AI tool before reaching the systems that sign wallet transactions. Its initial findings describe preparation stretching from June to the October 29 attack.
The exchange published the account on November 3, putting the loss at approximately $6.34 billion. The investigation remains ongoing, and outside security firms are being engaged to review the findings. The reconstruction is the company's account of the intrusion, rather than a completed independent forensic assessment.
A job interview became an entry point
The first stage described in the report involved a Wallet DevOps engineer who downloaded a tampered Homebrew installer in June while trying to install an AI coding tool. Security staff detected the anomaly, replaced his device and rotated related credentials. The incident nevertheless exposed information about his role and colleagues.
A different engineer was approached in September through a legitimate job-hunting platform. Someone posing as a project director arranged interviews with a supposed human-resources representative and then a person claiming to run a fictitious company. The first interviewer shared a social-media account containing personal photos and videos to build trust.
Near the end of the second interview, the engineer was told to download a coding assignment onto his work computer. The repository contained malware that ran during setup. The report says it replaced a legitimate development-tool component with a malicious version, established contact with an external server and concealed traces of the compromise.
The internal AI tool helped attackers move further
On October 20, the compromised computer became a route to two wallet engineers through an internal AI tool. The attackers found a token permitting container deployment on one engineer's computer.
On October 29, they accessed another engineer's device, used the stolen credentials to deploy a container and triggered a malicious script. The resulting access to the wallet-signing service let them initiate transactions outside the normal withdrawal process.
As Apex previously reported, the FBI attributed the theft to North Korean actors, while Pyongyang denied responsibility. The new account expands on the attack method without changing that dispute.
The report does not name the internal AI tool. It distinguishes that later compromise from the earlier attempt involving an AI coding tool, so the two should not be treated as a single application or installation.
Why stopping withdrawals didn't immediately stop the theft
The attackers also used Ethereum's EIP-7702 authorization mechanism to give an attacker-controlled contract partial execution rights over a hot wallet. Those on-chain permissions operated separately from the exchange's ordinary withdrawal infrastructure.
Suspending withdrawals therefore did not automatically cancel the malicious authorizations. They required a separate revocation process. The company says its multiparty-computation wallet setup, which did not have one private key available for an immediate revocation, added technical complexity and time to the response.
That explains the distinction between disabling a customer withdrawal function and stopping transactions already authorized through a different route. The investigation is reviewing signing policies, hot-wallet controls and the response process.
Funds replaced and systems rebuilt
The exchange reported approximately $2.85 billion frozen or intercepted, subject to reconciliation and market-price movements. It said 98% of affected token assets had been replenished as of October 31, with more illiquid assets still being purchased and funds exceeding the amount required to cover the loss set aside.
Its commitment was explicit:
"Binance will absorb the financial impact of the stolen funds, not our users."
Frozen assets and replacements are different measures; the 98% figure should not be read as the percentage recovered from the attackers. The company points users to its reserves page for the replenished holdings.
It says it has rebuilt the affected wallet environment and internal AI tool, replaced devices, decommissioned credentials and expanded behavioral monitoring. It is also planning a security research fund and work with AI companies and security firms.
The report leaves the next check to outside reviewers:
"We are engaging independent security firms for further review.