The October 29 attack on Binance hot wallets began well before the first transfers. In its preliminary account, the exchange said attackers posing as recruiters for a fictitious company interviewed a software engineer twice in September. At the end of the second interview, the engineer was asked to download a coding assignment onto a work computer. Setting up the project ran malicious code.
Binance said the attacker used the compromised computer and an internal AI tool on October 20 to reach two other engineers. On one device, the attacker found a token with permission to deploy software containers. Nine days later, stolen credentials were used to deploy a container and run a script involved in the wallet attack.
In its November 3 update, Binance put the value of affected assets at approximately $6.34 billion. It said about $2.85 billion had been frozen or intercepted, which does not mean those funds had all been returned. Binance said it would bear the losses. Its investigation was ongoing.
