Preliminary details from Binance's internal investigation into the massive cyberattack, which resulted in a $6.3 billion (€5.65 billion) loss, indicate that the perpetrators planned the operation over several months. The timeline provided by the exchange shows that the intrusion originated in June when an engineer on the wallet infrastructure team downloaded a manipulated installation while searching for an AI programming tool. Although the security team detected this anomaly, replaced the device, and rotated credentials, the attacker had already gained visibility into the roles of the targeted engineer and their colleagues.
The campaign intensified in September when a second engineer was contacted on an official job search platform by an individual posing as a project director. This social engineering effort included two interviews: a video conference with a fake HR manager and a chat session with a purported CEO of a fictitious company. At the conclusion of the final interview, the engineer was instructed to download a "task" onto their work computer, which executed malicious code during installation.
This zero-day malware replaced a legitimate component of a development tool with a malicious version capable of executing commands and connecting to an attacker-controlled server while erasing its own traces. Standard protection tools on the devices failed to detect the intrusion. On October 20, the attacker utilized the compromised machine and an internal AI tool to seize control of a DevOps engineer's computer and another software engineer's system, eventually locating a token with container deployment permissions.
The actual attack occurred on October 29 between 17:15 and 19:56. During this window, the intruder accessed the second engineer's computer using stolen credentials, deployed a container, and activated a malicious script to target wallet signing operations. Binance stated that it has since reconstructed the affected wallet system and AI tool, replaced devices, revoked all compromised credentials and tokens, and strengthened its security analysis, anomaly detection, and risk controls.
The exchange also reported detecting and thwarting 57 cyberattack attempts allegedly linked to North Korea throughout 2026. While Binance has implemented extensive countermeasures, the company noted that it will keep some specific actions confidential to avoid aiding potential future attackers. The investigation into the incident remains open.
Sources: elDiario.es.