Binance said the attack that affected $6.34 billion in assets on October 29 began with a fake job interview set up for an engineer in September.
Binance’s initial incident report, cited by Wu Blockchain, described how the attackers gained access to the company’s systems and reached its wallets. The first step in the attack was installing malware on an engineer’s device through fake job interviews.
The attackers later gained access to wallet engineers by also using the company’s internal AI tool. With the credentials they had stolen, they took control of the service used to sign wallet transactions. In this way, the breach that began on an employee’s device reached the system that enabled the movement of assets.
Why wasn’t stopping withdrawals enough?
The report also revealed that the attackers had exploited Ethereum’s EIP-7702 authorization mechanism. At that point, suspending the exchange’s withdrawal operations was not enough to remove the malicious authorizations already granted on-chain. Binance also had to revoke those authorizations.
This detail explains why stopping transactions within the exchange alone was not enough to respond to the attack: separate action was also needed to address authorizations defined on-chain.
How much of the affected assets was restored?
Binance said the total value of the assets affected by the attack was $6.34 billion. It reported that approximately $2.85 billion of that amount had been frozen or halted through intervention.
According to the company, 98% of the affected token assets had been restored as of October 31, and funds had been set aside to cover all losses. The investigation into the attack is ongoing.
We previously covered the decline in the Bitcoin balance of Binance’s user protection fund; the initial incident report now reveals the chain of access that explains how the billion-dollar attack was possible.
Not investment advice.