Key Takeaways
- How it started: Binance's initial report on the Binance hack traces it to a tampered Homebrew download in June 2026 and a fake job interview in September.
- How much: About $6.34 billion in digital assets were impacted on Oct. 29, and about $2.85 billion has been frozen or intercepted.
- Who pays and who is blamed: Binance says it will absorb the loss and cites the FBI in blaming North Korea, which denies any role.
Binance said on Nov. 3, 2026, that the attackers behind the Binance hack worked for months through a tampered software download, a fake job interview and an internal AI tool before reaching a wallet signing service and moving about $6.34 billion in digital assets on Oct. 29. About $2.85 billion has been frozen or intercepted.
How the Binance Hack Moved From a Fake Job Interview to Wallet Signing
In June 2026, a Binance wallet DevOps engineer downloaded a tampered Homebrew installation after searching on a search engine, in order to install a popular AI coding tool, according to Binance's initial report. Homebrew is a free tool developers use to install software. Binance replaced the device and rotated credentials, but the report says the engineer's role and team were exposed to the attacker.
In September, a second engineer was contacted on a legitimate job-hunting platform by someone posing as a project director. A second-round interview ended with an instruction to download an "assignment" onto his work computer, and its malware was not detected by Binance's endpoint security tools at the time. On Oct. 20, the attacker used that computer and an internal AI tool to gain control over the first engineer and a third, the report says. On Oct. 29, the attacker used the first engineer's stolen credentials on the third engineer's computer to deploy a container and launch the attack.
Binance Hack Timeline: Transfers Ran for Nearly Four Hours on Oct. 29
Between 20:05 UTC and 20:09 UTC, five Binance hot wallets, the online wallets an exchange uses for withdrawals, sent 233.46 million XRP to an attacker-controlled address. About 970,500 SOL, 44.2 million OP and 18,270 BTC followed. The attacker also used EIP-7702, an Ethereum feature that lets an account hand some execution rights to a smart contract, and set up delegations through 50 signing transactions that kept working after Binance suspended withdrawals. Because the wallet used multi-party computation, which splits signing among several parties, no single private key could revoke them at once. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC, 3 hours and 51 minutes after the first, by WYDE's arithmetic.
How Much of the $6.34 Billion Binance Has Frozen and Replaced
The $2.85 billion frozen or intercepted is 45% of the $6.34 billion, by WYDE's arithmetic, leaving about $3.49 billion not frozen. That is below the approximately $3 billion previously reported as frozen, FinanceFeeds reports, a figure WYDE covered on Oct. 30. "Binance will absorb the financial impact of the stolen funds, not our users," the company said. It says 98% of the impacted token assets had been replenished as of Oct. 31, that it has rebuilt the affected wallet system and internal AI tool, and that it plans an independent cybersecurity review and a security research fund with AI companies.
North Korea Denies the FBI's Attribution of the Binance Hack
Binance says the latest information released by the FBI indicates North Korea is responsible, and blockchain analytics firm Elliptic told CoinDesk its analysis supports attribution to TraderTraitor, a North Korean state-linked group. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied it on Nov. 2: "As regards this extra-large incident, the U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea again." Vasily Vidmanov, COO and head of investigations at AMLBot, told CoinDesk: "The evidence supporting the DPRK attribution is cumulative and goes well beyond speculation."
Binance says it detected and prevented 57 suspected North Korea-linked threat cases in 2026, and Decrypt reports that fake recruiting is a familiar route into crypto companies.
People Also Ask
How did the Binance hack happen?
Binance says the Binance hack came from a months-long campaign: a tampered Homebrew download in June 2026, a fake job interview in September that put malware on an engineer's work computer, and an internal AI tool the attacker used on Oct. 20 to gain control over two more engineers.
Who was behind the Binance hack?
Binance says the latest information released by the FBI indicates North Korea is responsible for the Binance hack, and Elliptic told CoinDesk its analysis supports attribution to the North Korean group TraderTraitor. North Korea denies the accusation.
Will Binance users lose money from the hack?
Binance says it will absorb the financial impact of the Binance hack, not its users. About $2.85 billion of the $6.34 billion impacted has been frozen or intercepted, and 98% of the impacted token assets had been replenished as of Oct. 31.
Sources: Binance, CoinDesk, Decrypt, FinanceFeeds.