TLDR Binance’s $6.3 billion hack on October 29 traces back to a fake software installer downloaded in June. A fake job recruitment process in September gave attackers a second foothold inside
Binance’s $6.3 billion hack on October 29 started with a fake software installer downloaded five months earlier, according to the exchange’s own incident report. The report, published November 3, describes a step-by-step campaign that used malware, a fake job offer and stolen credentials.
A rival exchange founder now says simple workplace rules could have stopped it. CoinEx founder Haipo Yang listed three security practices he believes Binance failed to follow.
The campaign began in June, when a wallet operations engineer downloaded a modified Homebrew installer. The employee was trying to install an AI coding tool at the time.
Binance said its security team spotted the suspicious activity. The team replaced the affected computer and rotated related credentials.
However, the incident exposed information about employees who worked on the exchange’s wallet infrastructure. Attackers used that information in the next stage.
In September, attackers targeted a second engineer through a fake recruitment process. They eventually persuaded the employee to download malicious software.
By October 20, the attackers had used compromised devices and an internal AI tool to reach more engineering systems. Nine days later, stolen credentials let them deploy malicious code tied to the unauthorized withdrawals.
Investigators linked the attack to North Korea’s TraderTraitor hacking unit. The FBI later attributed the theft to North Korean state-sponsored attackers, while North Korea rejected the claims.
Yang shared his critique in a post on X after Binance released its report. He argued the attack showed failures in operational discipline, not a lack of security technology.
The Binance incident exposed at least three mistakes that were entirely avoidable:
1. Development and operations environments were not fully isolated. Anyone with production access should operate from a dedicated machine used for nothing else, with no third-party software…
— Haipo Yang (@yhaiyang) November 3, 2026
“None of these require sophisticated technology. What was missing was discipline,” Yang wrote.
His first point was about separating work environments. He said employees with access to live financial systems should use dedicated computers, with coding, chat and web browsing done on separate devices.
His second point focused on authentication. Yang claimed one stolen credential could open production services without strong extra checks, and he recommended hardware security keys and tools such as AWS Session Manager.
His third point concerned multi-party computation, a setup that splits transaction signing across several participants. Yang said Binance’s signers did not independently check what they approved, making the system work like a single signature. “Multisig only works when the signers are mutually distrustful,” he wrote.
These claims are Yang’s own assessment. Binance has not publicly confirmed every weakness he described.
Binance co-CEO Yi He said the exchange blocked 57 suspected North Korea-linked cyber threats during 2026. These included fake job interviews, malicious developer tools, compromised software packages and fake video call apps.
“We intercepted many of them, but the cost of failing to stop even one was severe,” she wrote.
Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job… https://t.co/vMM9ATmKIr
— Yi He (@heyibinance) November 3, 2026
Co-CEO Richard Teng said Binance has replenished 98% of the affected assets. About $2.85 billion was frozen or intercepted, and the company has pledged to cover the full loss with corporate funds and reserves.
Binance also completed a Proof of Reserves check covering ten major cryptocurrencies, including Bitcoin, Ethereum, BNB and XRP. The check confirms asset backing for those tokens but does not show whether the gaps Yang described have been fixed.
The exchange said it has rebuilt affected wallet systems, replaced compromised devices and disabled linked credentials. It has also restored withdrawals for more Ethereum and Solana assets.
Binance plans an independent cybersecurity review and more spending on device protection and threat detection. It said some security measures will stay confidential so attackers cannot find weak spots.
The post Binance $6.3B Hack Started With a Fake Installer Five Months Earlier appeared first on Blockonomi.
