Binance's initial incident report, published November 3, 2026, says its $6.34 billion theft on October 29 began months earlier with a tampered developer tool and a fake job interview. For Cyprus CASPs and EMIs, the Binance hack incident report maps the specific controls that failed between a hiring lure and a hot wallet.
Key takeaways
- Binance's November 3 initial report traces the $6.34B theft of October 29 to a tampered Homebrew install in June and a fake recruiter's coding test in September.
- On October 20, attackers used an unnamed internal AI tool to reach two other engineers' devices; Binance has not explained how.
- An EIP-7702 delegation gave attackers partial control of an Ethereum hot wallet, and the MPC design delayed revocation until 00:10 UTC on October 30.
- About $2.85B was frozen or intercepted; the 98% figure refers to replacement assets, not recovered funds.
What does the Binance hack incident report say?
Binance says attackers spent about five months working from one engineer’s laptop toward its hot wallets before moving roughly $6.34 billion on October 29, 2026. The investigation is still open, and independent security firms will review the findings. HackRead reports that the FBI has attributed the attack to North Korea.
Co-CEO Richard Teng posted on X: “We are committed to covering all hacked losses through our company funds. Your assets are safe.” Nearly every link in the access chain was a person or a workstation, not a protocol flaw. The theft is about four times the February 2025 Bybit heist (around $1.5 billion), which the FBI also attributed to North Korea. The report adds Binance’s own detail to our earlier analysis for Cyprus CASPs.
How did a fake job interview reach a wallet engineer?
The attackers got in through two ordinary developer habits: installing tools and taking job interviews. In June 2026, a wallet DevOps engineer searching for an AI coding tool downloaded a tampered Homebrew installation. Binance detected it, replaced the device and rotated credentials, but no rotation revokes what the attackers had learned: the employee’s role and the wallet team’s internal relationships.
In September, a fake recruiter on a job-hunting platform asked a second engineer, Engineer B, to download a coding assignment onto a work laptop at the end of the second interview. Engineer B did. The repository swapped a legitimate pyenv file for a malicious one, giving the attackers command execution and a channel to their server; Binance has not named a malware family. Neither step involved an attachment or a macro prompt, which is why a social engineering assessment for engineers should use developer pretexts such as take-home coding tests.
What role did the internal AI tool play?
On October 20, the attackers used Engineer B’s machine and an unnamed internal Binance AI tool to reach the devices of Engineer A and Engineer C, the latter another wallet engineer. Binance has not explained how the tool made that possible, the biggest open question in the report. Any internal assistant that can open sessions, run commands or fetch files on colleagues’ machines is a remote administration channel and should be scoped and logged like one; AI agent penetration testing shows what it can actually reach.
Engineer A’s computer held a container deployment token, which turned a compromised workstation into a route into production.
What moved on October 29, and why did revocation lag?
On October 29, the attackers accessed Engineer C’s computer, used Engineer A’s stolen credentials to deploy a container, and launched a malicious script. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP, faster than any manual approval workflow could respond. Wallets on Solana and Optimism then sent about 970,500 SOL and 44.2 million OP, followed by 18,270 BTC.
On Ethereum, the attackers abused EIP-7702, which lets an account delegate certain execution rights to a smart contract, to give a contract they controlled partial execution rights over a Binance hot wallet. The private key was never exposed, and because the delegation sits on-chain, suspending withdrawals could not stop it.
Binance’s multi-party computation (MPC) wallets require several key holders to cooperate to sign. That guards against a single stolen key, but Binance said it also meant no single key was available to revoke the delegations immediately. “These challenges extended the time required to fully contain the unauthorized asset movements,” the report says. The last transfer, 2,961.9 ETH, sat pending until it settled at 23:56 UTC; Binance cleared the malicious delegation at 00:10 UTC on October 30.
How much was frozen, and what does 98% replenished mean?
As of November 3, about $2.85 billion, roughly 45% of the total, had been frozen or intercepted, a figure Binance says may shift with reconciliation and prices. The 98% figure is different: by October 31, Binance had replenished 98% of affected token assets with replacement assets from its own resources, not recovered coins. Binance says it has rebuilt the affected systems; no arrests or infrastructure takedowns have been reported.
What should Cyprus CASPs and EMIs test after the Binance hack?
Cyprus CASPs, EMIs and CySEC-regulated brokers can read the report as a test plan. A compromise of this scale would be a major ICT incident under DORA, which also covers MiCA-authorized CASPs: initial notification is due within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it.
- Hiring tasks never run on corporate hardware. Take-home assignments belong in a disposable VM or cloud sandbox, and endpoint monitoring should flag unknown repositories cloned onto wallet-team machines.
- No deploy tokens on general-purpose laptops. Container and CI/CD credentials should be short-lived, hardware-bound and issued only to hardened admin workstations.
- Map what internal AI tools can reach. Review each assistant’s connections to device management, chat or shells on other machines like any admin path.
- Rehearse on-chain revocation. The runbook should name who convenes the MPC key holders, how long that takes, and who alerts on EIP-7702 authorizations involving treasury addresses.
Testing should start from a wallet engineer’s laptop, not the perimeter, and MiCA and CASP penetration testing should cover the signing and revocation path.
FAQ
Did Binance customers lose money in the $6.34 billion hack?
Co-CEO Richard Teng said Binance will cover all hacked losses from company funds, and by October 31 it had replenished 98% of affected token assets.
Did a fake job interview lead to the Binance hack?
Partly. In September 2026, an engineer downloaded a fake recruiter's coding assignment onto a work laptop, and its malicious pyenv file gave attackers a foothold; a June Homebrew compromise had already revealed the wallet team's structure.
How much of the Binance hack was recovered?
About $2.85 billion was frozen or intercepted as of November 3, subject to reconciliation and prices. The 98% figure refers to replacement assets, not recovered funds.
To find out how far an attacker could get from one developer laptop, our assumed breach assessment starts exactly there and maps the route to your signing keys.