Binance Details Breach Behind $6.3 Billion Crypto Theft

Cryptocurrency exchange Binance published initial findings from an internal investigation into last week's breach, explaining how attackers took approximately $6.34 billion in digital assets. The company said the theft involved a multi-stage campaign combining fake recruitment interviews, malicious software downloads, compromised internal artificial intelligence tooling, endpoint intrusions, and an advanced transaction-authorization method.

Binance said approximately $2.85 billion in digital assets have been frozen or intercepted so far, subject to reconciliation and market price fluctuations. The exchange said it will absorb the financial impact of the stolen funds rather than passing losses to users, adding that it set aside more than 100% of the funds needed to cover the incident. As of Oct. 31, 2026, the company replenished 98% of the affected token assets, which are visible on its Proof of Reserves page, while it works to buy the remaining illiquid tokens.

Timeline of the intrusion

The sequence began in June 2026 when a wallet DevOps engineer downloaded a tampered Homebrew package to install a coding tool found via a search engine. Security staff replaced the device and rotated credentials after detecting the anomaly, but the incident revealed the engineer's identity and colleagues to the attackers. Binance said its security teams prevented 57 suspected North Korea-linked cyber threat attempts during 2026 involving fraudulent interviews, malicious software disguised as developer utilities, compromised packages, browser extensions, and fake video conferencing software.

In September 2026, an individual posing as a project director contacted another software engineer through a recruitment platform. The attacker arranged a video interview with a fake human resources representative who shared personal photos and videos to establish trust, followed by an interview on a chat application with someone claiming to be a chief executive. The engineer was instructed to download a coding assignment to a work computer. The repository contained zero-day malware that avoided endpoint security tools, altered development files by replacing pyenv components, created a new symlink, and opened a zsh session to communicate with an external server.

On Oct. 20, the intruder used the compromised machine and an internal artificial intelligence tool to reach the initial DevOps engineer and a third wallet software engineer. The attacker found a container deployment permission token on the DevOps engineer's computer. Between 17:15 and 19:56 on Oct. 29, the attacker logged into the third engineer's computer, used the stolen credentials to deploy a container, and ran a malicious script to reach wallet signing operations.

Remediation and response steps

As of Nov. 3, 2026, Binance rebuilt the affected wallet architecture and internal tools in a new environment, replaced hardware, decommissioned credentials, completed scans of employee computers, and increased behavioral monitoring. The company collaborated with police agencies, blockchain intelligence firms, and industry partners to trace stolen funds.

Binance hired external security specialists to conduct an independent review of the breach. The company also announced plans to increase spending on behavioral anomaly detection and establish a security research fund alongside artificial intelligence and blockchain firms.