Leading crypto exchange Binance has issued an update on its initial findings from an internal investigation of what led to last week’s successful hack and $6.3 billion heist.

Sophisticated, multi-stage campaign

Binance said that its current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

Hack timeline

June 2026

Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. A security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on Binance’s wallet infrastructure team was exposed to the hacker.

Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.

September 2026 – social engineering

Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.

In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches.

The second interview was conducted in a popular social chat app. Near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.

The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.

The script executed the below steps by applying obfuscation techniques to evade security detection.

CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_
MODIFY pyenv_ → 3,414 B
DELETE …/libexec/pyenv (3,344 B) ← remove the valid pyenv
RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version
DELETE /opt/homebrew/bin/pyenv (3,414 B)
ln (create a new symlink) + spawn zsh

October 20

Use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.

October 29

Reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.

What Binance has done

As of Nov 3, 2026, Binance said it has taken the following actions:

• Rebuilt the affected wallet system in a new environment.
• Rebuilt the affected internal AI tool and access controls.
• Replaced affected devices.
• Decommissioned credentials and tokens related to affected engineers.
• Completed enhanced security scans across all employee devices.
• Enhanced AI-based behavioural anomaly detection.
• Strengthened wallet-service risk controls.
• Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.

Binance reported it will continue to strengthen measures as the investigation progresses. There are a number of security measures which have been implemented (and are implementing) that will remain private to prevent malicious actors from compromising security.

Further actions

Binance is taking the following steps immediately.

Independent cybersecurity review. Engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate findings and recommend additional measures. The scope and findings of that review will inform continuing remediation work.

Expanded investment in AI security and prevention. Binance is increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.

Security research fund and industry initiatives. Binance is working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.

Heist update

Binance reiterated that its first responsibility is to protect users. The company said that it will absorb the financial impact of the stolen funds, not Binance users. Binance has already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on the company’s Proof of Reserves page. Binance is in the process of purchasing the outstanding, more illiquid assets.

Approximately USD $6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD $2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.