Binance's first incident report shows the hackers going through three engineers, a fake AI programming tool installation, a fake job interview, and an internal AI tool before withdrawing approximately $6.34 billion.

On November 3, Binance announced the first incident report about the theft on October 29, about 6.34 billion USD, equivalent to about 165 trillion VND, the largest hack in the history of digital currency exchanges. The exchange called this a "multi-phase campaign" that lasted several months, starting with a fake installation of the programming AI tool and ending with about 20 minutes of withdrawals. The FBI blames the North Korean group TraderTraitor. Pyongyang denied the accusation, calling it a "political provocation".

The first phase took place in June. A DevOps engineer from the wallet team, reportedly called "Engineer A", searched for a popular programming AI tool and downloaded a tampered Homebrew installation. Homebrew is a popular software package manager on Macs. The report does not say that the official Homebrew project was compromised, but rather that the attacker created a fake version to lure searchers. Co-CEO Richard Teng describes it as a fake version of a tool for programmers. Binance's security team detected the anomaly, replaced the machine, and changed related credentials, but the roles of the engineer and colleagues in the wallet infrastructure team were exposed to the attacker. The report does not confirm that the attacker maintained continuous access from June to October.

In September, another software engineer, "Engineer B", received a message from someone claiming to be "Project Manager" through a legitimate job search platform. He went through two rounds of interviews. The first round is a video call with a person playing the role of HR, who also shares a personal social network account to build trust. Round two is a conversation with a person claiming to be the CEO of a bogus company, via a chat application. At the end of the session, he was given an "assignment" consisting of a code repository, and downloaded it to his work computer. The malicious code, according to Binance, uses concealment and detection evasion techniques, including replacing a development tool component with a malicious version to run commands.

On October 20, the attacker used Engineer B's infected machine to abuse an internal Binance AI tool, thereby taking control of Engineer A's machine and a third software engineer, "Engineer C". On Engineer A's machine, they see a token granting permission to deploy the container. Binance has not named this AI tool and has not explained how it is used to spread to other machines. The report also did not point out any vulnerabilities in the AI ​​model itself.

On October 29, the attacker logged into Engineer C's machine using the information taken from Engineer A and then ran a piece of malicious code to launch an attack on the wallet's transaction signing system. Funds began leaving Binance's hot wallets across multiple blockchains around 4:20 p.m. (US Eastern time). Binance said it is withholding some technical details so as not to help other attackers.

Regarding money, Binance said it has compensated about 98% of the affected assets, using the SAFU User Safe Asset Fund (about 1 billion USD in Bitcoin), company treasury and futures contract insurance fund. Cryptocurrency companies, including Tether, Circle and Ripple, have helped freeze about 2.8 to 3 billion USD, equivalent to about 74 to 78 trillion VND, mainly in stablecoins. The rest are Bitcoin, Ether and XRP, assets that cannot be frozen directly. Chainalysis said the stolen funds were mixed on-chain with funds from last month's Bitget heist, which was also attributed to North Korea, and is the strongest evidence yet for this connection.

The exchange reopens withdrawals from November 1. According to reported data, customers net withdrew about 3.64 billion USD, equivalent to 2.1% of total assets, or about 95 trillion VND, in a short time afterward, then the withdrawal speed gradually decreased.

Binance said it has rebuilt the affected wallet system with its internal AI engine, replaced the compromised devices, disabled the credentials and tokens of the engineers involved, and expanded security scanning across all employee devices. The exchange is inviting independent security companies to evaluate the incident and plans to establish a research fund on AI security in the blockchain environment. Binance also said that in 2026 it detected and blocked 57 threats suspected to be tied to North Korea, including fake job interviews, software masquerading as programming tools, tampered software packages, fake video meeting applications and credential theft campaigns.

Binance emphasized that the results are preliminary. The investigation continues, the independent review is not complete.