Binance Reveals Full Chain of $6.3 Billion Security Breach
Cointime reports: Binance has published an initial incident report detailing the theft of approximately $6.3 billion in assets, tracing the attack through a sophisticated social engineering campaign that exploited AI tools and internal access. The exchange confirmed that 98% of affected tokens have been replenished as of October 31, with losses covered by the SAFU fund and company capital.
How the Attack Unfolded
The breach began in June 2026 when a wallet operations engineer downloaded a tampered Homebrew package while searching for an AI coding tool. Although the security team replaced the device after detecting anomalies, the engineer’s wallet infrastructure permissions remained exposed. In September, attackers posing as project directors contacted a second software engineer via a recruitment platform, conducting video and messaging interviews before sending a malicious 3,414-byte file disguised as a coding assignment. The file bypassed endpoint protection and used internal AI tools to locate traces linked to the first engineer. On October 30, the attackers accessed a third employee’s computer and transferred roughly $6.34 billion.
Response and Recovery
Binance has frozen or intercepted about $2.85 billion, and the exchange has generated a new zero-knowledge proof reserve snapshot covering 44 tokens—up from just 10 in the previous snapshot—allowing users to independently verify that their balances are backed at least 1:1. Withdrawal services for six assets are expected to resume by the end of next week.
Regulatory and Industry Fallout
The incident has drawn attention from U.S. regulators, with the Federal Reserve and the Office of the Comptroller of the Currency contacting banks to assess potential systemic risk. Singapore’s MAS has warned the public against trading with unregulated firms. Security firm SEAL estimates the attackers were dormant for about eight weeks before the theft, while blockchain intelligence company BitOK estimates North Korean hackers stole roughly $7.61 billion across 38 incidents in the first ten months of the year, with approximately $4.75 billion remaining unrecovered.
Broader Implications
The attack highlights the growing sophistication of state-linked cyber threats and the vulnerabilities introduced by remote work, AI-assisted development, and interconnected wallet infrastructure. It also underscores the importance of transparency in post-incident disclosure. Binance’s decision to publish a detailed timeline and provide user-verifiable reserve proofs sets a new benchmark for accountability, though the involvement of multiple employees and the prolonged dwell time raise questions about internal security protocols across the industry. As regulators intensify scrutiny, exchanges may face pressure to adopt stricter operational security standards and more robust incident response frameworks.
