❯ Binance details the $6.34 billion attack chain involving fake recruitment and compromised internal tools

A prolonged intrusion preceded the theftBinance published initial findings on November 3 about its October 29 security incident. The Block’s account of the report says attackers infected an employee’s computer through fake recruitment and a malicious coding assignment, then used an internal AI tool to reach wallet-related systems. Approximately $6.34 billion in digital assets was affected.

Several entry points reached the walletsThe report describes a months-long chain: an intrusion attempt involving tampered developer tools in June, fraudulent recruiting in September, and access to more engineers’ devices through a compromised computer and internal tools on October 20. Attackers obtained deployment credentials and later accessed wallet-signing services to initiate unauthorized transfers. BleepingComputer also details the connections between devices, credentials and container-deployment privileges.

Rebuilding systems and reopening withdrawalsBinance says it closed the entry points, rebuilt or replaced affected systems, strengthened device controls and commissioned an independent security review. It began reopening withdrawals for additional assets in phases on November 3. The investigation remains preliminary, with the findings showing how links between endpoints, internal tools and privileged production systems widened the consequences of compromise.

▮ SIGNALWhen internal AI tools connect to privileged environments, separation between identities, devices and deployment rights helps determine the reach of an endpoint breach.