Read this article on bsc.news Binance has published a preliminary account of how attackers breached its wallet infrastructure in the Oct. 29 incident, which it says affected about $6.34 billi
Binance has published a preliminary account of how attackers breached its wallet infrastructure in the Oct. 29 incident, which it says affected about $6.34 billion in digital assets. The exchange traced the attack to fake recruitment interviews, malicious software and an internal AI tool.
Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation to install a popular AI coding tool after searching for it online, according to a security report Binance published on Tuesday, as reported by CNBC. On Oct. 20, the attacker used the compromised computer and an internal AI tool to gain control of the wallet developer's system and that of a second wallet developer on the team, NBC News reported.
Binance's preliminary review described a multistage intrusion involving malicious software, employee devices, internal AI tools and unauthorized access to a wallet-signing service, which attackers used to initiate unauthorized transactions on Oct. 29 across several networks, TokenPost reported.
Five Binance hot wallets sent 233.46 million XRP ($XRP) to an attacker-controlled address, while other transfers involved approximately 970,500 SOL ($SOL), 44.2 million OP ($OP) and 18,270 BTC ($BTC), according to Security Affairs. TokenPost put the XRP transfers between 4:05 and 4:09 p.m., a window of about four minutes.
Binance has said the $6.34 billion figure reflects assets affected rather than a confirmed theft total. TokenPost noted the figure counts assets affected, not a confirmed theft total, and could change with further review and market-price fluctuations.
Binance said $2.85 billion in digital assets tied to the incident had been frozen or intercepted by Nov. 3, and that it plans to hire an independent cybersecurity firm to conduct a full review.The exchange said it will absorb all financial losses from stolen funds rather than pass them to users, and that 98% of affected token assets had been replenished by Oct. 31.
On remediation, Binance co-CEO Richard Teng said the exchange has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens tied to the affected engineers, and expanded security scans across employee devices.Binance is also increasing investment in AI-enabled detection and working on a security research fund and targeted initiatives with leading AI companies.
On attribution, the FBI has blamed a North Korean hacking group, a claim North Korea has rejected, NBC News reported.
