Binance: Attackers Used Tampered Homebrew Packages and Internal AI Tools to Breach Multiple Employee Devices

Nov. 3: According to Reuters, Binance said attackers used compromised computers and internal AI tools to control wallets.
According to Binance's official preliminary investigation report, the Oct. 29 security incident involved about $6.34 billion in digital assets, of which about $2.85 billion has now been frozen or blocked. Binance said the losses will be borne by the platform itself, and that as of Oct. 31 it had replenished 98% of the affected token assets. The investigation shows that the attackers used fake job interviews, tampered Homebrew installation packages and internal AI tools to progressively breach multiple employees' devices, gained access to the internal wallet signing service, and then used Ethereum's EIP-7702 authorization mechanism to move XRP, SOL, BTC, ETH and other assets out of hot wallets. The FBI said North Korea is responsible for the incident. Binance has rebuilt the affected systems and will hire an independent third party to conduct a review.