Binance published a report on the October 29 hack and named the attackers' entry point. One of the exchange's engineers was job hunting and downloaded a "test assignment" from a fake employer onto his work computer. The file contained malicious code.
The FBI attributed the $6.4 billion theft to the North Korean group TraderTraitor. This is a hacker group linked to the DPRK and attacks on crypto services.
Why this matters to a trader. The money was taken from the exchange's hot wallet - the storage from which the platform processes client withdrawals.
How did they get to the engineer?
Jimmy Su, Binance's Chief Security Officer, described the scheme step by step.
- First contact. In September, the developer was contacted through a real job site by someone posing as a project director.
- Video interview. The fake recruiter held a conversation and showed a social media profile with personal photos to build trust.
- File with code. In the second interview, the "CEO" asked him to download a programming assignment. The malicious code in the file slipped past antivirus.
How did the attack unfold?
The first trace appeared earlier. Back in June, another engineer installed a tampered Homebrew package while looking for an AI tool. The device was replaced, but he and his colleagues in the wallet department remained under surveillance.
- October 20 - the attackers, through an internal AI service, reached the computers of two wallet engineers.
- October 29 at 23:05 MSK - the money left the exchange.
- October 30 at 03:10 MSK - the leak was contained.
Why did it take four hours to put out?
Access was taken via the Ethereum EIP-7702 mechanism. The attacker gained execution rights over the hot wallet. A hot wallet is storage connected to the network, from which the exchange processes withdrawals.
Binance's hot wallets run on distributed signing. No single key can revoke access there, so the permission could not be disabled with a single command.
What happened to the money?
Part of the funds were stopped. About $2.85 billion was frozen, with help from Tether, Circle and the US Secret Service. The exchange replenished 98% of the affected tokens from its own funds.
- $10.97 billion - withdrawn by clients over 46 hours
- $5.28 billion - net outflow, according to Binance head Richard Teng
- 2% of the exchange's assets - how Changpeng Zhao estimated the first $3.6 billion of outflow; he expected 10-30% to leave
- 57 attempts linked to the DPRK that Binance repelled over the year
Key point: Binance will bring in independent specialists to investigate the incident.
What does this mean for a trader?
Platform risk is always there. How different models of access to capital work is covered in the academy.
Did you check this morning where your money is?
The scheme is ridiculously simple. One person opened the wrong file, and $6.3 billion was gone in four hours. Trading a noticeable volume on an exchange means keeping your money there and taking on the platform's risk yourself. Prop trading works differently: after a paid selection process, the company provides a trading nominal, and the trader receives an agreed percentage of the result. For crypto, the rules vary by program: some have two coins, others have the whole list with leverage limits. It's worth understanding the mechanics in a calm market.