Binance Hack Timeline: How Attackers Compromised Three Engineers to Access Wallet Signing Service

WuBlockchain mapped the attack timeline based on Binance’s preliminary investigation. In June, Wallet DevOps Engineer A downloaded a tampered Homebrew installer while setting up an AI coding tool. Although Binance detected the incident, replaced the device and rotated credentials, information about the engineer and colleagues was exposed. In September, Engineer B downloaded a malicious code repository during a fake job interview, compromising his work computer. On October 20, attackers used the compromised device and an internal AI tool to gain control over Engineers A and C, discovering a container deployment permission token on A’s computer. On October 29, they accessed C’s computer, used credentials stolen from A to deploy a container and execute a malicious script, and ultimately initiated unauthorized asset transfers through Binance’s internal wallet signing service.