The Binance hack was not a romance with a North Korean spy, and it was not one careless click. On 3 November 2026 the exchange published its first account of the 29 October theft: a tampered
The Binance hack was not a romance with a North Korean spy, and it was not one careless click. On 3 November 2026 the exchange published its first account of the 29 October theft: a tampered installer in June, a fake job interview in September, an internal artificial-intelligence tool used as a bridge on 20 October, and a container launched from a third engineer's computer on the day the wallets moved. Binance puts the impact at about $6.34 billion, says about $2.85 billion has been frozen or intercepted, and says 98 percent of the affected token assets had been replenished by 31 October. The report cites the FBI's finding that North Korea was responsible. It does not say an employee was a spy.
That split is what the early coverage flattened. A viral post blamed a honey trap and an unattended laptop, and pinned the tale on blockchain investigator ZachXBT. On 1 November, co-CEO Yi He wrote on X, in Chinese, that the more dramatic story was not true and that ZachXBT had not said it. Binance told The Crypto Times the claim was "completely false." The report also leaves out the tabloid version in which one employee simply handed the exchange over during a job hunt. What it confirms is colder. Software engineer B had a profile on a legitimate job platform that mentioned Binance. He took two interviews with people posing as a project director, an HR representative, and the chief executive of a company that did not exist, then downloaded an "assignment" onto his work computer. Reuters reported that he was seeking a new job. Endpoint tools missed the program because it was new.
Having followed Binance's posts since the first hot-wallet alerts on 29 October, the operational lesson is the gap between a paused withdrawal switch and a live instruction already on a blockchain. Suspending withdrawals could not stop every movement, Binance said, because the attackers used Ethereum's EIP-7702 mechanism to delegate execution rights to a contract they controlled. The hot wallet used multi-party computation, so no single private key could revoke that delegation at once. In a brokerage, that is the difference between locking the dealing screen and cancelling a payment mandate that has already been lodged.
The write-up, posted on X at 14:33 UTC on 3 November, calls this "a sophisticated, multi-stage campaign" and "not a single isolated breach or a simple phishing incident." The attackers combined fake recruitment interviews, malicious software, compromised internal AI tooling, endpoint compromise, and an advanced way of authorizing transactions. Binance apologized and said the incident should not have happened. It called the post an initial report.
June is easy to skip because no money moved. Engineer A, on wallet DevOps, downloaded a tampered Homebrew installer to set up a popular AI coding tool he had searched for. Security detected it, replaced the device, and rotated credentials. The remaining damage was exposure: his role, and his colleagues on the wallet team, were visible to the attacker. FinanceFeeds had already reported the early line, which pointed at a compromised DevOps laptop and no private-key leak.
September is the interview. A person posing as a project director found engineer B on a real job platform. The first round was a video call with a purported HR representative, who shared a social account with personal photos and videos. Binance called that "more advanced and deceptive than previously seen social engineering approaches." The second interview, on a social chat app, was with someone claiming to be the CEO of a fictitious company. The assignment ran code during setup, replaced a legitimate developer-tool component, and opened a channel to an outside server. The attacker hid the activity. The endpoint product did not recognize the program.
On 20 October the attacker used engineer B's computer and an internal AI tool to take engineer A's machine and a third wallet engineer's, labeled C. On A's computer sat a container-deployment permission token. On 29 October, between 17:15 and 19:56 UTC, the attacker logged on to C's computer, used credentials stolen from A, deployed a container, and triggered a script. The public theft started at 20:05 UTC, outside the normal withdrawal process, through an internal wallet-signing service.
The opening burst moved 233.46 million XRP in four minutes, then about 970,500 SOL, 44.2 million OP, and 18,270 BTC. The attacker used the signing service against EIP-7702, delegating execution rights to a contract without exposing the private key. Binance said 50 signing transactions set that up. It then lived on-chain, outside the ordinary withdrawal system. Staff needed a special revocation because multi-party computation left no single key. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. At 00:10 UTC on 30 October, an authorization from the Binance14 hot wallet to the zero address cleared it.
Co-CEO Richard Teng posted minutes later. "This wasn't one mistake or one breach - it was a months-long campaign," he wrote. "We're publishing the full report because the lessons go far beyond Binance." No user bears the loss, he said. The company had set aside more than the full amount, 98 percent of impacted tokens had been replenished, the rest was still being bought, and withdrawals had broadly resumed. About $2.85 billion had been frozen or intercepted with law enforcement, issuers, and blockchain intelligence firms. "The speed of coordination could not be matched in traditional finance." On CNBC, in a clip carried by the network's Squawk on the Street account, he said: "This shouldn't have happened. We take full responsibility... We are fully accountable."
Yi He filled in the cast the same afternoon, again in Chinese. DevOps engineer A downloaded faulty software. Engineer B was the person who was socially engineered. Through him, she wrote, the attackers reached AI permissions. In the three months between, Binance intercepted other social-engineering attempts. Another post of hers called the approach targeted bait, not an accident. Binance is describing a chosen wallet team, approached twice, after a June install had already named who sat on it.
The fix list is concrete. Binance said it rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced devices, decommissioned credentials and tokens tied to the affected engineers, scanned employee machines, widened AI-based behavioral monitoring, and tightened wallet-service risk controls. It is working with law enforcement and industry partners. Next come an independent cybersecurity review, more spending on detection and developer-environment security, and a research fund with AI companies and security firms. The outside review's findings are not public.
The first-hour response was issuer freezes and a withdrawal halt. FinanceFeeds tracked that from the opening alerts, including the early TraderTraitor attribution by TRM Labs and Chainalysis, which landed before Binance named a state. On 3 November the report cited the FBI finding that North Korea was responsible. The BBC said the Secret Service has been assisting, and that Pyongyang rejected the claim.
Binance already knew the shape of this lure. It runs monthly phishing tests and, as chief security officer Jimmy Su has described, can push repeat failures toward termination. The red team has used fake recruiter approaches. North Korean operators have run the same play, often called Contagious Interview, against crypto and AI firms for years. FinanceFeeds covered research that counted thousands of reached IP addresses. On 27 October Binance said it had blocked several attempts that week. The report now places the one that worked in September, still useful on 29 October. A test that punishes a click, and a build system that lets a wallet engineer run an outside repository, are not the same control.
Binance's gross is about $6.34 billion impacted. The frozen-or-intercepted figure in the same post is about $2.85 billion, subject to reconciliation and price moves. Those two company numbers put the frozen share at about 45 percent. That is arithmetic on Binance's print, not a new census. It matches, on the frozen dollars, a separate tally. Elliptic, as FinanceFeeds reported on 2 November, estimated about $2.85 billion frozen or seized, roughly 44 percent of a gross it put near $6.43 billion, with about $3.24 billion still in linked addresses, mostly bitcoin and ether. The freeze tally converged. The gross totals still differ by about $90 million. A single "stolen" number without a source and a clock mixes a company loss with an analyst's mark.
The clock is the sharper correction. Early notes, including TRM's, described most of the value leaving in about 20 minutes. Binance's report supports a fast open and refuses a clean stop. The XRP sends sit in four minutes from 20:05 UTC. The last unauthorized ether transfer finalized at 23:56 UTC. The EIP-7702 authorizations lived on-chain, so the withdrawal halt did not kill them. FinanceFeeds had already walked through how that delegation kept assets moving.
Early public account Binance report, 3 November 2026 One DevOps laptop and something close to a single action Engineers A, B, and C, from June through 29 October A North Korean operative in a relationship with staff Not in the report. Yi He called that story untrue on 1 November North Korea unproven, because Binance had not named a state The report cites the FBI finding that the DPRK is responsible Most of the money gone in about 20 minutes, then a stop Opening sends in minutes. Last unauthorized ETH at 23:56 UTC Pausing withdrawals ended the theft The on-chain delegation kept working until 00:10 UTC on 30 OctoberA second mix-up is the word "AI." Elliptic found no sign that autonomous agents directed the laundering: more than 40,000 transactions and about 12,000 wallets looked like ordinary automation. Binance said an internal AI tool was the 20 October springboard from engineer B onto two other machines. One claim is about laundering software. The other is about a company tool abused during the break-in. They are not the same fact.
The FBI previously attributed about $1.5 billion taken from Bybit in February 2025 to the same TraderTraitor activity. Binance's $6.34 billion is more than four times that, and both the BBC and the exchange call it the largest crypto theft on record. Yi He said on 30 October that the affected sum was about 2 percent of user assets and public reserves, which is why replacing most of it from inventory was plausible. The BBC separately reported more than $3.6 billion in customer withdrawals once the rails reopened. Covering the hole and watching clients leave are different balance-sheet events.
The FBI alert of 31 October says the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion from Binance on or about 29 October, and calls the activity TraderTraitor. With the Secret Service and IRS Criminal Investigation, the bureau watched stolen assets move mainly into ether and asked firms to block listed addresses. Binance points at that alert and then describes the path in.
Pyongyang answered the same day. Kim Yo Jong called the accusations another "sinister attempt" by the United States to damage North Korea's public image, the BBC reported. The denial does not remove the FBI alert or TRM's high-confidence call. For a compliance desk, the working paper is the address list.
In Washington the hack was already a custody fight. President Donald Trump said on 31 October that his administration was examining the breach, and CFTC chairman Michael Selig cited offshore venues outside U.S. safeguards. The Digital Chamber's Cody Carbone asked Congress for multi-party transfer approval, privileged-access controls, and incident reporting. FinanceFeeds set that out in the congressional-pressure piece. The 3 November report changes what a serious comment has to say.
The letter answered the first story: a laptop that could submit withdrawals, and no private-key leak. The report now says the wallet already used multi-party computation, and that this is why the EIP-7702 delegation could not be revoked with one key. A rule that only says "require multi-party authorization" describes a control Binance says it had, and that control did not end the outflows. The missing object in the policy text is the on-chain approval that does not notice a withdrawal pause. Comments on the CFTC's proposed crypto-market framework are due on 14 December 2026. This report sits inside that window.
A legal track runs beside that. Edwin Coe lawyers warned that a public promise to cover losses from the SAFU fund and company money may not match the customer contract. FinanceFeeds reported the warning. The 98 percent figure is what Binance says it has done, not a ruling that every contract now matches the posts. That gap is the lawyers' point. The report accepts an FBI attribution, then spends its length on controls any custodian would recognize: who may install a tool, who may run code on a work machine, who holds a deployment token, and how fast an on-chain approval can be killed.
The independent review is the next document a board can use. Binance said outside experts will check the findings, and that some fixes will stay private. Two questions are still open. How did a replaced developer tool sit undetected from September to 29 October on a machine that could reach wallet engineers? And why did the internal AI tool have a path from one workstation to a DevOps engineer who still held a deployment token after the June rotation?
Engineer B is not described as an accomplice. He was on a real job platform and was handed a coding test. Wallet engineers will keep looking for work. The control that matches the report is a ban on outside installers and take-home repositories on any machine that can see production wallets. Binance's red team already knew the lure. The report shows it still left a foothold. Exchanges that change something in the next two quarters will treat that test on a work laptop as a privileged-access exception.
Issuers and investigators locked about $2.85 billion. The rest of Binance's impact figure had to be replaced from company inventory or chased. Yi He said the company already held most of the affected tokens, which is why 98 percent replenishment by 31 October was plausible. A smaller venue cannot copy the promise. If an on-chain delegation can outlive the withdrawal switch, recovery is a race with issuers plus a checkbook. Binance had the checkbook.
The 3 November report starts in June, when a wallet DevOps engineer downloaded a tampered installer for an AI coding tool. The device was replaced, but the attacker kept a view of the team. In September a second engineer put a malicious assignment on a work computer during a fake interview. On 20 October an internal AI tool reached two more machines. On 29 October stolen deployment credentials launched the signing attack.
The report does not say that. On 1 November Yi He rejected a viral claim, attributed to ZachXBT, of a romantic approach by a North Korean operative. His public posts were about fund flows. The FBI says TraderTraitor carried out the theft, and Binance cites that finding. A state-linked campaign and a spy on the payroll are different allegations. Only the first is in the official record of the Binance hack.
Binance says about $6.34 billion was impacted and about $2.85 billion has been frozen or intercepted, roughly 45 percent of its own gross. Elliptic used the same frozen amount against a gross near $6.43 billion. As of 31 October, 98 percent of impacted token assets had been replenished from company resources.
Attackers used EIP-7702 to delegate a hot wallet's execution rights to a contract they controlled. Those authorizations sat on Ethereum and ignored the withdrawal switch. Multi-party computation meant there was no single key to revoke them. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. The delegation was cleared at 00:10 UTC on 30 October.
It says the wallet system and the internal AI tool have been rebuilt, devices replaced, related credentials retired, and employee machines scanned. Richard Teng said withdrawals had broadly resumed, with the last 2 percent of tokens still being bought. Some new controls will stay unpublished.
Do not let wallet-team machines run outside installers or take-home coding tests. Do not assume a withdrawal pause kills every approval already on-chain. Binance says it blocked 57 suspected North Korea-linked attempts in 2026 and still lost this one. The attempts it stopped and the one that landed used the same family of lures.
