Binance published its account on Tuesday, November 3. It covers five months of attacker work behind the October 29 theft of $6.34 billion, per CNBC, CoinDesk and The Block. The report traces the intrusion to a June tampered install, a September staged recruitment process, and an October 20 move through an internal AI tool. That move put a container deployment token in the attackers' hands. On October 29, they deployed a container from a third engineer's computer and drained funds via the wallet-signing service, per the report.
In June, one wallet DevOps engineer searched online for a widely used AI helper. He fetched a tampered Homebrew installer, per CoinDesk and The Block. Binance spotted the anomaly, gave the engineer a fresh device and rotated credentials. The exposure did not end there: the episode left the engineer's role and wallet-team colleagues visible to the attacker, per the report.
In September, attackers contacted a second engineer on a job platform, posing as a project director, per the report. Next came a video call with a supposed human-resources representative. The interviewer shared personal photos on social media to build trust. A second round, with a supposed chief executive of a nonexistent company, ended with an assignment repository. That repository carried zero-day malware endpoint tools missed at the time, per CoinDesk, opening a channel to an attacker-run server.
On October 20, the attackers moved from the compromised machine through an internal AI tool to two more wallet engineers, per the report. One of those machines carried a container deployment token. On October 29, the attackers deployed a container from a third engineer's computer with stolen credentials, per CoinDesk, and ran a malicious script. They also used Ethereum's EIP-7702 mechanism to let an attacker-run contract transact from a hot wallet, per CoinDesk and The Block.
Attack timeline
| Stage | Date | What the report records |
|---|---|---|
| Tainted install | June 2026 | Installer fetched during an AI tool setup; device replaced, credentials rotated |
| Fake recruitment | September 2026 | Job-platform approach, two interviews, assignment repository |
| Lateral move | October 20, 2026 | AI tool used to reach two more engineers; token found |
| Drain | October 29, 2026 | Container deployed; signing service used; EIP-7702 abused on a hot wallet |
Recovery math
| Measure | Figure | MarketRadar calculation |
|---|---|---|
| Affected assets | $6.34 billion | Reported total |
| Frozen or intercepted | $2.85 billion | 45.0% of the affected total |
| Replenished by October 31 | 98% of affected tokens | $6.21 billion of token value |
| Still to buy | 2% of affected tokens | $0.13 billion |
Percentages are MarketRadar calculations. Frozen funds and replenished funds are separate buckets, not figures to add together.
Binance said $2.85 billion had been frozen or intercepted, per CoinDesk and The Block, and 98% of affected tokens had been replenished from company funds by October 31, per its own post. Binance added it had set aside more than the loss amount, per its post, and customers would not bear the impact. CNBC rounded the frozen figure to about $3 billion.
Why it matters
The detail changes the question exchanges now face. A hiring-channel lure and a developer-tool download did as much damage as any wallet-code flaw. Binance said it stopped 57 suspected attempts with a North Korea link during 2026, per its report. The FBI has attributed the October 29 attack to North Korea, per CoinDesk. Binance's report cites the FBI finding without making its own attribution, per CoinDesk. Pyongyang rejected the claim on Monday through state media, per Bitcoin Magazine. See also the earlier replenishment update, FBI attribution report and withdrawal-resumption update. Bitcoin printed $77,491 in MarketRadar's 00:39 PKT November 4 snapshot, up 1.02%.
What to watch
- Findings of the independent expert review Binance commissioned
- Reconciliation of the $2.85 billion frozen or intercepted
- Whether other exchanges disclose recruiter-lure attempts after Binance's 57 in 2026
- Any update on Binance's temporary withdrawal restrictions on certain assets
Key points
- November 3 report: June install, September fake interview, October 20 AI-tool move led to the $6.34 billion theft
- $2.85 billion frozen; 98% of tokens replenished by October 31
- 57 suspected attempts with a North Korea link stopped in 2026; FBI attribution cited, not adopted
- Wallet system and AI tool rebuilt; independent review commissioned
- Bitcoin $77,491 in the November 4 snapshot, up 1.02%
MarketRadar take
The chain matters more than any single step. Each stage alone looked routine: a tool download, a job interview, an internal tool query. Together they opened the signing service. For traders, track the 2% still being bought and the $2.85 billion frozen pile.
