The attack and the documented phases
According to Agenda Digitale, on October 29 hackers attributed by the FBI to the North Korean group TraderTraitor stole 6.34 billion dollars in digital assets from Binance, the world's largest cryptocurrency exchange. The Wall Street Journal, cited by the source, reports that the first wave of transfers was concentrated in about twenty minutes, with some transactions completed only hours later.
The reconstruction published by Binance on November 3 describes a lengthy preparation. In June, an engineer from the Wallet DevOps group allegedly downloaded a counterfeit installation of Homebrew; the anomaly was detected and the device replaced, but the attackers had already obtained information on internal roles. In September, a second engineer was allegedly lured by fake recruiters, who had him download a coding exercise containing malware onto his company computer. On October 20, the intruders allegedly used an internal AI tool to reach other workstations and find a token useful for container distribution. On October 29, between 17:15 and 19:56 UTC, they allegedly exploited a third engineer's computer and stolen credentials to activate the malicious code.
The role of hot wallets and EIP-7702 delegation
The target was the service that authorizes and signs hot wallet transactions, the online wallets used to manage liquidity and withdrawals. When the system began producing apparently valid operations but issued by the intruders, the coins flowed out to external addresses without the usual customer request process. The first documented operations, between 20:05 and 20:09 UTC, involved 233.46 million XRP from five hot wallets; other assets then left, including about 970,500 SOL, 44.2 million OP and 18,270 bitcoin. According to Elliptic, cited by the source, the illicit withdrawals affected eleven blockchains.
On Ethereum, the hackers exploited the EIP-7702 feature, which allows a wallet to delegate certain functions to a smart contract via signature. Binance reports that the attackers obtained 50 signed authorizations to circumvent nonce changes and get the malicious delegation accepted. The source specifies that this was not a direct theft of the private key: the exchange's systems had made it possible to sign commands useful to the intruders. Blocking withdrawals from the site did not revoke a delegation already recorded on-chain; the last unauthorized transfer was finalized at 23:56 UTC on October 29, and the revocation of the Ethereum delegation came at 00:10 UTC on October 30.
Reimbursement, frozen funds and open questions
In the November 4 statement, Binance claims it has restored 98% of the stolen assets with its own resources and has set aside funds to cover the entire amount, stating that the loss will be borne by the company and not by users. The source distinguishes this figure from that of approximately 2.85 billion dollars frozen or intercepted along the thieves' path: the first concerns the funds made available again by the exchange, the second the blocked assets.
Agenda Digitale notes that the case highlights the difference from bank deposits: for cryptocurrencies, protection depends on the type of intermediary, its soundness, the liabilities provided for by law and the concrete possibility of recovering stolen assets. Still to be verified are the complete outcome of the technical investigation, the actual consistency of the declared reserves and what would happen to an exchange with no billions to mobilize. The source also does not clarify whether the replenishment is already final in accounting terms.
Details on the role of the AI tool are described by Binance but are still under investigation; the available reconstruction does not document that an AI agent autonomously decided the theft.
