The short version
- Binance hack report: the $6.34 billion theft began with a tampered download in June and a fake job interview in September that put malware on an engineer’s work laptop.
- From there the attackers used an internal AI tool to reach two more engineers and Binance’s signing service; $2.85 billion is frozen and Binance covers the rest.
- Next: the independent security review and the hunt for the roughly $3.5 billion still out of reach. We’ll post every step on Base Camp on X.
The Binance hack report is out, and the $6.34 billion theft did not start with a leaked key. It started with a job interview. In its initial findings, published on Tuesday, Binance says North Korea-linked attackers spent five months working through three of its engineers before they ever touched a wallet.
The exchange calls it “a sophisticated, multi-stage campaign” and points to the FBI’s finding that North Korea was behind it. About $2.85 billion of the stolen coins has been frozen or intercepted so far, and Binance says its users won’t carry the loss.
Binance co-founder Yi He shared the report with a number that stings:
Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job
How the Binance Hack Happened, Step by Step
The report lays out four steps, and each one looks small on its own. These are the Binance hack details the exchange has shared so far.
- June: a fake download. A Wallet DevOps engineer searched for a popular AI coding tool and installed a tampered copy of Homebrew, a common Mac installer. Security caught it, swapped the laptop and rotated his credentials. But the attackers now knew who sat on the wallet team.
- September: the interview. A second engineer was approached on a legitimate job site by a fake “Project Director.” A friendly HR video call came first, then a chat interview with a fake CEO, who asked him to download an “assignment” onto his work computer. The code inside hid malware that no security tool flagged at the time.
- October 20: the AI tool. From that laptop, the attackers used an internal AI tool to reach the first engineer and a third one. The first engineer’s computer held a token that could deploy software containers.
- October 29: the hit. Between 17:15 and 19:56 UTC, the attackers logged into the third engineer’s computer, deployed a container and started the script.
Within minutes, five hot wallets sent 233.46 million XRP to the attackers. Roughly 970,500 SOL, 44.2 million OP and 18,270 BTC followed. Binance says it blocked 57 suspected North Korea-linked attempts this year. One was enough.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Binance Could Not Stop It Quickly
Pausing withdrawals was not enough. The attackers used Binance’s own signing service to set up EIP-7702 permissions, an Ethereum feature that lets a wallet hand some control to a smart contract. Those permissions lived on-chain, outside Binance’s systems, so switching off the exchange did not switch them off.
In other words, the door stayed open after Binance locked its own front gate. The hot wallet used Multi-Party Computation (MPC), so there was no single private key to cancel the permissions quickly. The team had to build a special procedure. The last unauthorized transfer, 2,961.9 ETH, landed at 23:56 UTC, almost four hours after the first one. Binance cleared the delegation at 00:10 UTC on October 30.
SIDE TRAIL: Binance Hack: $6.3B Drained in the Biggest Crypto Theft Ever, Withdrawals Paused
What the Binance Hack Report Says Comes Next
Binance says it has rebuilt the hit wallet system and the internal AI tool in a new environment, replaced the affected devices, scrapped the engineers’ credentials, scanned every staff device and tightened its wallet risk controls. As of October 31, 98% of the stolen tokens had been replaced, with the rest, mostly less liquid coins, still being bought.
Next come an independent security review, more spending on AI-based threat detection and a security research fund with AI companies. Some details stay out of the Binance hack report on purpose, so attackers can’t use them.
For everyone else, the lesson is plain. A recruiter you don’t know, a “take-home test” to run on your computer, or an installer picked from search results is how this one began. Our guide to the most common crypto scams covers the same tricks at a smaller scale.
BNB trades at $685 at the time of writing, down 1.5% on the day and about 8% for the week, between $680 support and its 50-day moving average at $748.
What counts next is the independent review and whether any of the roughly $3.5 billion still out of reach can be frozen before it is laundered.
TRAIL MAP: Protecting Your Crypto Accounts: 2FA, Passwords and Phishing
Teddy has been trading crypto since 2016. The focus is altcoins and EMA setups: finding coins sitting on key levels, waiting for support to hold or a range to be reclaimed, and trading the move from there. Bitcoin sets the tone, but the opportunities are usually in the alts.
More from Teddy
