WirecompaniesDextape brief
Binance Details Four-Month Path From Tainted Developer Install to $6.34 Billion Drain
In its initial report on the Oct. 29 theft, the exchange describes a months-long campaign that ended with a stolen deployment token and an Ethereum EIP-7702 trick on an MPC hot wallet.
Dextape brief
Binance has published its first detailed account of an intrusion that drained about $6.34 billion. The breach began in June, when a wallet-team DevOps engineer installed a tampered Homebrew package, and continued in September through a fake job interview that delivered malware to a second engineer. Five hot wallets sent 233.46 million XRP to an attacker address, while Solana and Optimism wallets lost about 970,500 SOL and 44.2 million OP, and another wallet sent 18,270 BTC. Because multi-party computation blocked single-key revocation, Binance needed a special procedure to clear delegations, finishing at 00:10 UTC on Oct. 30. The company says 98% of affected assets were restored by Oct. 31, though its own updates showed lower figures.
Why it matters: The case shows how social engineering and tampered developer tools can reach exchange wallet infrastructure, a risk relevant to crypto firms.
Read the full story
Dextape context
Built from Dextape’s own wire, stories and glossary.
Terms in this story
- Hot wallet
- A wallet whose keys sit on an internet-connected device, such as a phone app or browser extension.
Mentioned in this story
Open a coin page for its current price.