Binance details $6.34 billion attack linked by FBI to North Korea

Summary

Binance released its preliminary report on the October 29 attack, during which approximately $6.34 billion in digital assets were stolen. The report details a months-long campaign by a North Korea-linked group. The attackers combined a trojaned AI coding tool, a zero-day exploit via a fake hiring process, and the misuse of an internal AI tool as an attack hub. While the FBI attributes the operation to North Korea, Binance states that it has covered the losses and recovered 98% of the affected assets by October 31.

Why it matters

This is the largest single cryptocurrency exchange theft on record. The incident concretely demonstrates that AI-assisted development tools and internal AI assistants have become valid attack surfaces for state actors. A months-long social engineering chain involving fake interviews, zero-day payloads, and lateral movement via an AI tool proves that perimeter and endpoint defenses alone are insufficient when internal credentials and tools are compromised. Additionally, it highlights the fragility of MPC-based wallet architectures when EIP-7702 authorizations are exploited, as revoking authority cannot be done instantly.

Highlights

• A mixed zero-day payload delivered via a fake 'coding exercise' in a job interview bypassed all endpoint protections on the target machine.
• The attacker accessed two engineers' machines by passing through Binance's own internal AI tool and stole a container deployment token.
• The EIP-7702 smart contract authorization granted the attacker partial on-chain control over the hot wallet. This made it impossible for Binance to instantly revoke authority by freezing its withdrawal infrastructure.

Critical take

The text is essentially a lightly edited repetition of Binance's own preliminary report. Consequently, the North Korea attribution relies solely on the FBI's claim. The timeline, technical details, and the '98% recovered in two days' figures are based entirely on the company's own statements without independent forensic verification. Labeling the document a 'preliminary report' while simultaneously announcing a security fund and an independent review is a classic PR move that blurs the line between transparency and reputation management.