Observed incident

Binance traces wallet theft through an internal AI tool

Reported

Published here

What happened

Binance says an attacker pivoted from a compromised developer endpoint through an internal AI tool to two other engineers, obtained deployment credentials and reached wallet signing. The exchange reported about $6.34 billion in affected assets.

Parties and reporting

AI tools and systems: Unnamed internal AI tool, Wallet signing service, EIP-7702 authorizations

Outcome

Selected withdrawals reopened November 1. By November 3 Binance had rebuilt affected systems, revoked credentials and reported about $2.85 billion frozen or intercepted, subject to reconciliation. It said it would absorb the loss. Investigation continued.

Operating lesson

Separate AI tooling from wallet deployment identities, enforce independent signing controls and rehearse revocation of on-chain authorizations after a service shutdown.

Evidence and limits

The incident was public October 29. Binance identified the internal AI-tool pivot in its November 3 preliminary findings. The FBI attributes the theft to North Korea’s TraderTraitor activity. The model, exact tool exploit and attacker use of autonomous AI were not disclosed.

Sources