TLDR
- Binance says the Oct. 29 hack grew from a months-long campaign that began in June.
- An engineer installed a tampered software package, and another took a fake coding test.
- Hackers reached the wallet-signing service and moved funds outside normal withdrawals.
- About $6.3 billion was affected, and Binance says it replaced 98% of affected tokens by Oct. 31.
- The FBI blames North Korea, while Kim Yo Jong denies any role.
Binance has released a postmortem on the $6.3 billion theft from its wallet system. The exchange says the attack was not a single mistake. It describes a campaign that lasted months and targeted its own staff.
— Binance (@binance) November 3, 2026
The first step came in June. A Wallet DevOps engineer searched online for a popular AI coding tool. The engineer then downloaded a tampered Homebrew installation instead of the real one.
Binance detected the malware and replaced the affected device. By then, the attackers had learned the engineer’s role. They also knew who else worked on the wallet infrastructure team.
How the Fake Job Interview Worked
In September, attackers posed as recruiters and contacted a software engineer. They asked the engineer to complete a coding assignment. The file was actually malware.
Binance says the malware used advanced hiding methods. This kept it from being caught by the exchange’s security tools. It also made the later investigation harder.
On Oct. 20, the attackers used that engineer’s computer and an internal AI tool. This gave them access to two more engineers’ systems. They found a container deployment permission token on one computer.
With those credentials, the attackers installed malicious software in the wallet infrastructure on Oct. 29. They then reached the internal wallet-signing service. This service approves crypto transactions.
That access let them move funds outside the normal withdrawal process. Binance co-CEO Richard Teng said on X that this “wasn’t one mistake or one breach.” He called it a months-long campaign.
Binance also said the attackers used Ethereum’s EIP-7702 feature. It lets wallets give transaction permissions to smart contracts. Transfers kept going even after the exchange paused withdrawals.
The exchange’s multiparty computation wallet system spreads control over transaction signing. Binance says this made it harder to cancel those permissions.
Recovery and Attribution
Binance says about $6.3 billion in digital assets was affected. Its latest count shows $2.85 billion was frozen or intercepted. Partners such as Tether and Circle helped freeze nearly $3 billion, according to the exchange’s estimate.
The exchange says it will absorb the loss instead of passing it to customers. As of Oct. 31, it had replenished 98% of the affected token assets. Founder Changpeng “CZ” Zhao said Binance covered the loss without outside financial help.
Binance has resumed withdrawals. It rebuilt the affected wallet system in a new environment. It also removed credentials and tokens tied to the affected engineers.
The exchange finished enhanced security scans on all employee devices. It also improved its AI-based system that flags unusual behavior. Binance is working with law enforcement and blockchain intelligence firms to trace the remaining funds.
The FBI has attributed the attack to North Korean hackers. It is the largest crypto hack on record. On Tuesday, Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied involvement. She said the FBI’s claim was politically motivated.
Co-founder Yi He said Binance’s security team stopped 57 suspected North Korea-linked threats in 2026. These included fake job interviews, malicious software packages and social engineering attempts. She said the cost of missing even one was severe and that this “should never have happened.”
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
