Key Highlights
On-chain analyst Fabiano has shared a timeline of the October 29 Binance security breach, describing how attackers allegedly spent five months gaining access to the exchange’s internal systems before the incident in which approximately $6.34 billion in assets were affected.
In a November 3 post on X, Fabiano (@FabianoSolana) said attackers used social engineering and compromised developer tools to access employee devices. He outlined incidents dating back to June, followed by a suspected recruitment-related attack in September and further access to internal systems in October.
Fabiano also alleged that an on-chain authorization allowed a malicious contract to control a Binance hot wallet, potentially enabling transfers to continue after the exchange began shutting down affected systems.
His timeline and technical explanations remain his account of the incident. While blockchain intelligence firms have separately linked the breach to North Korean actors, the specific sequence of employee compromises described by Fabiano has not been independently established.
Fabiano’s timeline begins in June, when a Binance engineer reportedly searched for an artificial intelligence tool and downloaded Homebrew, a software package manager.
According to the post, Binance detected the download and provided the engineer with a replacement laptop and new passwords. Fabiano suggested that attackers may nevertheless have obtained information about employees responsible for managing the exchange’s wallets.
The post does not explain how the attackers allegedly obtained that information or establish whether the June incident directly enabled the later breach.
Fabiano identified another incident in September involving a second Binance engineer who reportedly received a job offer presented as a major career opportunity. The alleged recruiter, posing as a CEO, asked the engineer to download a coding assignment onto a work laptop. Fabiano said the downloaded material replaced one of the engineer’s development tools with a malicious copy.
He suggested that the compromised tool gave attackers access to the engineer’s work environment. The post does not identify the person behind the recruitment approach or explain how the malicious software operated.
Fabiano said the attackers used Binance’s internal AI tool on October 20 to access the computers of two wallet engineers. According to his account, they then located a token that could be used to deploy code into Binance’s wallet system.
This stage suggests that the attackers had allegedly reached systems involved in wallet operations. However, Fabiano did not identify the internal AI tool or explain the token’s technical function.
Fabiano’s timeline places the final stage of the operation on October 29. He said an attacker accessed a Binance engineer’s computer at 17:15 UTC and remained there for 2 hours and 41 minutes.
The major withdrawals reportedly began at 20:05 UTC, with Fabiano listing the following transfers:
These figures come from Fabiano’s account. His post does not provide transaction hashes or identify the destination wallets for each transfer.
Fabiano said the attacker used an on-chain authorization that gave a malicious contract control over a Binance hot wallet. He argued that shutting down Binance’s internal systems could not immediately stop the transfers because the malicious contract already had the necessary authorization on the blockchain.
The analyst also discussed Binance’s wallet security arrangement, which does not rely on a single private key. He suggested that this setup made it difficult for engineers to reverse the authorization quickly after the malicious contract gained control.
According to his timeline, the final transfer cleared at 23:56 UTC, while the alleged unauthorized access was terminated at 00:10 UTC on October 30.
The post does not provide the underlying contract details or independently establish how the authorization bypassed Binance’s security controls.
Fabiano put the total amount affected by the breach at approximately $6.34 billion and said around $2.85 billion had been frozen. He described the incident as what he called the 58th attempted attack against Binance linked to North Korean actors, claiming that the exchange had blocked 57 such attempts earlier in the year.
The post did not provide supporting records for the figure of 57 blocked attacks or explain how the $2.85 billion frozen amount was calculated.
The claimed frozen amount should be distinguished from recovered funds. Assets being frozen or restricted does not necessarily mean they have been returned to Binance or affected users.
On October 30, The Crypto Times reported that blockchain intelligence firms Chainalysis and TRM Labs linked the breach to North Korean hackers associated with the TraderTraitor group. The report said Binance had reported approximately $6.34 billion in affected assets and that roughly $3 billion had been frozen through efforts involving the exchange and industry partners.
The findings provide additional context for Fabiano’s claims about North Korean involvement. However, the firms’ attribution and Fabiano’s timeline are separate accounts. Their findings do not independently verify the specific employee-compromise sequence or the alleged 57 earlier attacks described in his post.
In a separate November 3 post on X, Fabiano alleged that North Korean-linked actors moved approximately $1.46 million through Circle’s cross-chain bridge using a route involving Jupiter Lend.
He identified a Solana wallet, AffzFD, which he said had been flagged by the FBI. According to his account, the funds were routed through a series of wallets before being deposited into Jupiter Lend. A newly created wallet then withdrew an equivalent amount minutes later.
Fabiano described the subsequent movement as a series of swaps into USDC and transfers out of Solana through Circle’s bridge. He said the funds moved through Noble and dYdX before returning to Solana at a new wallet.
He listed 16 transfers out of Solana worth approximately $1,463,410 and 19 transfers back worth approximately $1,463,400. Fabiano said none of the funds had been frozen.
Based on the difference between the reported amounts, he characterised the route as a way to move another $1.46 million at a cost of approximately $10. His post did not provide a complete transaction-level breakdown or independently establish that the wallets were controlled by North Korean actors.
Kash Dhanda, Jupiter’s Chief Operating Officer, responded to Fabiano’s post, disputing the suggestion that Jupiter Lend had been used to launder the funds.
Dhanda said the activity differed from an earlier incident involving Aave, where attackers allegedly used stolen stablecoins to borrow assets that could not be frozen by the issuer. “In Lend’s case, they just deposited and then withdrew, which was entirely trackable by following the LP tokens,” Dhanda wrote.
He added that Jupiter had been monitoring the activity in real time and questioned why the transactions had been carried out. “I’m honestly not sure why they even did this,” Dhanda said.
Dhanda’s response disputes Fabiano’s laundering characterisation. Neither account establishes the beneficial ownership of every wallet or the final disposition of the funds.
Also Read: Binance Co-CEO Takes Responsibility for $6.3B Hack, Details Security Overhaul
Key Highlights The Capital Markets Alliance filed a lawsuit on November 3 in the Southern…
AI SummaryShowOn November 3, Bullish announced adding Solana, Aptos, and Ethereum to its token‑share platform.Earlier, on…
AI SummaryShowAttackers leveraged AI agents to exploit undocumented vulnerabilities in GitBook’s infrastructure, gaining unauthorized access…
Key Highlights LIT traded at $3.35 on November 3 at 16:54 UTC, gaining 8.8% over…
Sam Altman’s ChatGPT AI predicts ‘Will crypto recover?’. When prompted, the OpenAI bot gave an…
Bitcoin (BTC) might not need another halving, another wave of institutional adoption, or even another…
This website uses cookies.
Read More