Binance said attackers gained access to its wallet-signing service and moved funds outside its normal withdrawal process in an Oct. 29 breach affecting about $6.3 billion in digital assets. In its latest accounting, the exchange said $2.85 billion had been frozen or intercepted. It said it would absorb the losses rather than pass them to customers and had replenished 98% of the affected token assets as of Oct. 31.
According to Binance’s security report, the attackers first gathered information from a compromised device in June, then used a fake coding assignment to compromise another engineer’s computer in September. They used that computer to obtain deployment credentials and install malicious software in the wallet infrastructure on Oct. 29. Binance said unauthorized transfers continued after it suspended withdrawals because the attackers exploited Ethereum’s EIP-7702 mechanism; its multiparty computation wallet system complicated efforts to revoke the permissions. The FBI attributed the attack to North Korean hackers, but Kim Yo Jong denied the country’s involvement.
