Binance has released findings detailing how attackers breached internal systems to drain more than $6.34 billion from exchange hot wallets. The breach combined social engineering, zero day malware, and exploited smart contract authorizations to bypass standard security checks. The exchange has recovered 98% of the affected assets and pledged full reimbursement for customer losses.
The security compromise started when an engineer downloaded a modified Homebrew installation package while configuring an artificial intelligence coding utility. Binance flagged the affected computer, swapped the hardware, and rotated employee credentials, but the attackers still obtained identity records for the wallet operations unit. The attackers then set up a fake recruiter video interview with an engineer who maintained exchange wallet infrastructure. During the interaction, the attackers delivered a project repository containing zero day malware that bypassed computer defenses undetected.
Attackers accessed the internal server control infrastructure through a corporate artificial intelligence utility. Once inside, they triggered automated transfers from 5 exchange hot wallets, moving 233.46 million XRP, 970500 SOL, and 44.2 million OP within a 4 minute window. The attackers also transferred 18270 BTC to independent addresses. To drain Ethereum assets, the attackers exploited network mechanics by granting permission to a malicious smart contract, authorizing operations through 50 signed transactions.
Taking hot wallets offline and disabling standard withdrawal systems did not stop the outflow immediately because granted smart contract permissions remained functional on the blockchain. Because the wallets relied on multi signature key systems, revoking a single cryptographic key could not halt the drain. Attackers executed a final transaction of 2961.9 ETH before security teams revoked the contract permissions 14 minutes later. Binance managed to freeze or intercept approximately $2.85 billion in stolen tokens, bringing total recovered funds to 98%. The exchange maintains reserve backing exceeding 100% of the lost capital to guarantee that user accounts suffer zero financial loss.
