Binance released a postmortem on Tuesday blaming a $6.34 billion theft on a 'sophisticated, multi-stage campaign' that began in June, when an engineer downloaded malicious software while installing a popular AI coding tool. CEO Richard Teng stressed it was not 'one mistake or one breach.'

The entry point: a software engineer contacted through a legitimate job-hunting platform by someone posing as a project director, who was told to download an 'assignment' containing a malicious code repository during a second interview.

The malware evaded Binance's endpoint security tools, and the attacker removed traces of the initial compromise.

By October 20, the hackers used the compromised engineer's device — and, according to crypto.news, a compromised internal AI tool — to reach two wallet engineers.

They accessed critical cryptocurrency wallet tools by October 29 and used an internal wallet signing service to trigger the first transactions, which moved almost $400 million out of the platform.

After the company was alerted, $1.4 billion in bitcoin still left the platform, followed by 50 other transactions bringing the total to $6.34 billion.

Blockaid identified 50 submitted EIP-7702 authorizations, one of which successfully delegated execution rights to a malicious contract, per crypto.news.

The surprise is the scale of the repeated targeting Binance says it absorbed: throughout 2026 it caught and stopped 57 separate attempts by North Korean actors, using fake job offers, malware disguised as developer tools, compromised browser extensions and malicious video conferencing apps.

'We intercepted many of them, but the cost of failing to stop even one was severe,' co-CEO Yi He wrote on X, per crypto.news.

Elliptic's tracing covered roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions, with the hackers moving funds to a new wallet every 25 seconds and still holding an estimated $3.24 billion.

Binance froze about $2.85 billion in assets by coordinating with other platforms and suspended withdrawals, but it admitted it lost valuable time because it had to develop specialized procedures on the spot to revoke access and authorizations.

As of the November 3 report, 98% of impacted token assets had been replenished, funded through the Secure Asset Fund for Users, Futures Insurance Fund excess reserves and corporate treasury, with withdrawals progressively restored — 31 additional assets on Ethereum and 20 on Solana on November 3.

The company says it has rebuilt affected systems, tightened device and wallet-service controls, expanded AI-based anomaly detection and hired an outside security firm for a full review. The FBI attributed the theft to TraderTraitor; North Korea denied involvement.