Binance has now told customers how roughly $6.34 billion left its hot wallets in a few minutes on October 29: through a chain that started with a recruiter’s message and a coding test. The exchange’s November 3 incident report describes a “sophisticated, multi-stage campaign” that reached three engineers’ machines over four months, and it names a Python repository handed to a candidate as the point where the attackers got a foothold.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
North Korea has been blamed by the FBI, and Pyongyang has called the allegation “preposterous nonsense.”
From a fake recruiter to a work laptop
According to BleepingComputer’s account of the report, the attackers used a fake job interview to get an employee to install malware. A bogus recruiter posing in an invented project-director role contacted a Binance software engineer through a legitimate job platform in September, as Yahoo’s summary of the post-mortem lays out. The engineer sat through two interviews, one on video with a fake HR representative and one with someone posing as the chief executive of a fictitious company. Near the end, the candidate was told to download a coding assignment onto his work computer. The repository replaced a component of a Python version-management tool with a copy that could run commands and call out to an attacker-controlled server. Binance’s endpoint security did not flag it.
Homebrew, an internal AI tool and five hot wallets
The coding test was not the first compromise. In June a wallet DevOps engineer searching for a popular AI coding tool had downloaded a tampered Homebrew installer, according to Hackread’s reading of the report. Binance detected that and replaced the device, but the intruders had already learned the engineer’s role and who worked on wallet infrastructure around him.
On October 20 the attackers used the September laptop and an internal AI tool to reach two wallet engineers’ devices; one held a container deployment token. Nine days later they deployed a container with stolen credentials, ran a malicious script and reached the wallet signing service. Between 20:05 and 20:09 UTC, five hot wallets moved 233.46 million XRP, followed by Solana and Optimism wallets, about 18,270 BTC and 2,961.9 ETH. Binance has not explained how the AI tool opened the path to the other two engineers.
Binance also described the abuse of an Ethereum mechanism, EIP-7702, to give an attacker’s contract partial execution rights over a hot wallet without exposing its private key. Because Binance runs a multi-party computation setup, no single key could be revoked on the spot, which slowed containment; the malicious delegation was cleared at 00:10 UTC.
Security researchers had been warning about this exact approach. Federico Charosky of Quorum Cyber told Bloomberg that approaching exchange engineers with fake job interviews is a common tactic, one in which the target is talked into installing malicious code that gives attackers a route onto the device and the wider company network. The Next Web’s account stresses that Bloomberg framed this as a general pattern in the first days after the theft, before Binance published its own sequence of events.
The speed of the final stage stands out. TRM Labs said the heist itself took about 20 minutes, and Binance halted customer withdrawals afterward, saying it planned to reopen them on the Sunday. The exchange also set aside about $6.34 billion of company funds to cover the losses.
Attribution, losses and what remains unanswered
The FBI attributed the theft to North Korea on the weekend after the heist, tying it to the TraderTraitor group, which it also linked to the $1.5 billion Bybit theft of February 2025, according to The Next Web. Ari Redbord of the blockchain analytics firm TRM Labs told Bloomberg that the attack was unprecedented and an inflection point, adding that North Korea stole about as much in one evening as in the previous six years combined. The LBC report on the FBI alert adds that the bureau expects further laundering stages and that the funds were being converted into ether.
On the money, Binance said about $2.85 billion had been frozen or intercepted as of November 3, subject to reconciliation and price moves, and that 98 percent of affected token assets had been replenished by October 31. The second figure means replacement assets, not recovery of stolen coins. Co-CEO Richard Teng said the company intends to cover every hacked loss from its own funds.
TRM Labs put the heist in a wider frame: North Korea-linked groups accounted for about 76 percent of crypto hack losses in the first four months of 2026, and two April attacks, on KelpDAO and Drift Protocol, produced about $600 million in combined losses. Security experts cited by Bloomberg also suspect North Korean operators may use AI to research targets and trick employees, though that remains an assessment and not a confirmed finding. Fortra’s Gina Cardelli questioned how one compromised employee device could lead to sensitive financial systems at all. Binance has not answered that publicly; it says it rebuilt affected systems, replaced devices and tightened access, and that independent firms will review the findings.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
