Binance, the world's largest cryptocurrency exchange, published on 3 November its preliminary report on the breach that drained about $6.3 billion in digital assets from its infrastructure — the largest crypto heist on record. The document describes not an isolated failure but a campaign that ran for months and began with a hiring process that never existed.
The timeline the company reconstructed
According to the report, as described by The Block:
- June — the attackers went after a Wallet DevOps engineer through a tampered installation of Homebrew, a package manager widely used by developers. Binance detected the problem, replaced the device and rotated the credentials. By Fortune's account, the engineer reached the tampered file through an ad rather than the official channel — and before being discovered, the operation had already mapped his role and those of the staff who managed the company's wallets.
- September — the attackers posed as executives in a fictitious recruitment process. A purported "project director" approached an engineer on a job platform, arranged a first interview with an "HR representative" and a second with someone claiming to be the chief executive of a company that did not exist. The point was to get the engineer to download a coding "assignment" — which was the malware.
- 20 October — from that machine and an internal artificial intelligence tool, the attackers took control of two other engineers' devices, where they found a permission to deploy containers.
- About nine days later — using stolen credentials, they deployed a container and ran the script that launched the attack on the wallets, authorising transactions through the exchange's signing infrastructure.
How much came back
Binance says it froze or intercepted about $2.85 billion and replenished 98% of the affected assets from its own reserves and other sources; the remaining 2%, in less-traded currencies, was still being acquired. Fortune reported that Tether and Circle froze the stolen stablecoins, which made the recovery of about $2.5 billion possible.
Withdrawals were suspended for about 48 hours and reopened over the weekend, according to Fortune; on 3 November the exchange said the reopening was proceeding in phases, and that hourly deposits had come to exceed withdrawals.
Attribution and reaction
Binance says the FBI linked the attack to North Korea. Its own investigation identified social engineering, malware and the misuse of internal AI tooling. On 2 November, the sister of North Korean leader Kim Jong-un called the FBI's claims a "grave political provocation".
The company says it detected and prevented 57 attempted attacks attributed to North Korea in 2026.
Co-chief executive Richard Teng summed up the episode: "This wasn't one mistake or one breach — it was a months-long campaign." The exchange also apologised: "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users."
The measures listed include closing the entry points, rebuilding or replacing affected systems, tighter device controls and expanded AI-based anomaly detection. The company will also commission an independent cybersecurity review.
The detail that matters
No step in the chain described depends on breaking cryptography. The route was human at the start — a CV, an interview, a file — and administrative at the end: a permission to deploy containers. The internal AI tool, built to make the company's own staff more productive, worked as a corridor between machines.
With information from The Block and Fortune.
