Binance attributes the $6.34 billion theft to a multi-stage attack that targeted two engineers, first through a tampered version of Homebrew in June and then through a fake recruitment process in September. The attackers subsequently hijacked an internal AI tool to access other machines, obtain a deployment token and reach the transaction signing service on October 29. They transferred 233.46 million XRP, roughly 970,500 SOL, 44.2 million OP and 18,270 BTC from five hot wallets. Despite withdrawals being suspended, on-chain EIP-7702 delegations enabled the transfers to continue, including 2,961.9 ETH, until the malicious authorizations were revoked. Binance says 98% of the affected assets had been recovered by October 31, while the FBI attributes the attack to the North Korean unit TraderTraitor.
Source: Read the original article
