The first two stories about the Binance theft were about a wallet and about money laundering. The third story, published by Binance itself on November 3, is about hiring.

Binance’s initial incident report describes a campaign that ran for months and never needed a private key. The attackers got into three engineers’ machines, found a container deployment token, and used Binance’s own signing service to move $6.34 billion out of hot wallets in a few hours (Binance).

That is a different failure mode from the one most exchange security models are built around. It is not a stolen seed phrase, not a compromised HSM, not a rogue insider. It is a recruitment process, a search result, and an AI tool that turned out to be a bridge between machines.

The timeline Binance published

June 2026. A Wallet DevOps engineer, identified as Engineer A, downloaded a tampered Homebrew installation while trying to install a popular AI coding tool he had searched for. Binance’s security team detected the anomaly, replaced the device, and rotated all related credentials. What they could not undo was the exposure: the attackers now knew who he was, what he did, and who else worked on the wallet infrastructure team.

Throughout 2026. Binance says its security team detected and prevented 57 suspected North Korea-linked cases, including fake job interviews, developer tooling disguised as popular packages, compromised browser extensions, and fake video conferencing apps. That number is worth sitting with. The playbook was not novel. It was recurring.

September 2026. A second engineer, Engineer B, was contacted through a legitimate job platform by someone posing as a project director. The profile referenced his Binance experience. The first interview was with a supposed HR representative who shared personal social media content to build rapport. The second was with a person claiming to be the CEO of a company that did not exist. It ended with a request to download a coding assignment onto his work computer. The assignment contained a malicious repository that executed on setup, swapped in a rogue copy of a legitimate developer tool component, and opened a channel to an attacker server. Binance says endpoint protection did not detect it at the time.

October 20. The attackers used the infected machine and an internal AI tool to gain control of Engineer A’s system and a third wallet engineer’s system. Binance’s report does not explain how the AI tool was used for that. It does say the first engineer’s computer held a token that allowed container deployments.

October 29. At 20:05 UTC, the attackers signed into the third engineer’s computer, deployed a container using credentials taken from the first, and ran a malicious script. Between 20:05 and 20:09, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Solana and Optimism hot wallets lost roughly 970,500 SOL and 44.2 million OP. A hot wallet then sent 18,270 BTC.

Then came the Ethereum part. Binance says the attacker used the internal signing service to exploit EIP-7702, the feature that lets an account delegate execution rights to a contract, and gave an attacker-controlled contract partial execution rights over a hot wallet. Fifty signing transactions were involved. Because the wallet used multi-party computation, no single key could revoke the delegation, so containment required a procedure built on the spot.

The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the delegation at 00:10 UTC on October 30 (CNBC).

We checked that last claim against the chain this week. The Binance 14 wallet that was delegated, 0x28c6c06298d514db089934071355e5743bf21d60, now returns empty bytecode, so no delegation is active. The first receiving address, 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, still holds about 1.175 billion USDT and 823 million USDC, the same stablecoin balances we measured on October 30. Eight days later, the frozen money has not moved.

The recovery ledger, and what the percentages mean

Binance’s numbers have moved faster than its prose.

On October 31, Recovery Update #3 said about 90% of affected assets had been replenished. On November 2, Update #5 and BBC reporting put it at roughly 95%. On November 4, Update #7 said 98%. The November 3 incident report also uses 98%, but dates the figure to October 31, which does not match its own update from that day (Binance Update #7).

The direction is clear even if the labels are loose. Binance set aside more than 100% of the required funds, has restored the backing for most balances, and is still buying the last 2%, which it describes as less liquid tokens sourced on the market and over the counter.

Frozen is a separate column. The report says roughly $2.85 billion has been frozen or intercepted, subject to reconciliation and price changes. That is issuer action, mostly stablecoins, plus exchange and bridge cooperation. It is not money returned to Binance, and it is not money returned to users. It is money sitting still while lawyers and issuers work out what happens next.

The user-facing number is the withdrawal queue. On November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC, a net outflow of about $3.64 billion, or roughly 2% of the $171 billion it reported under management (BBC). Withdrawals have reopened in phases since, most recently on November 6 with another batch of assets across BSC, Base, Ethereum, Optimism, Polygon, Arbitrum, Avalanche, Tron and Sui.

And the reserves proof got wider. The snapshot taken at 00:00 UTC on November 4 covers 44 tokens, up from 10, with a zero-knowledge proof that Binance said would take 50 to 60 hours to generate. That is a genuine improvement in verifiability, and also a reminder that proof of reserves shows backing at a moment in time, not solvency, and not the absence of a hole.

What is still unexplained

Three things stand out.

How the AI tool was used. Binance says the attackers used an internal AI tool to move from the infected machine to two other engineers. It does not say whether the tool leaked credentials, executed actions, or simply made discovery easier. That detail matters for every company deploying internal AI assistants with access to code and infrastructure. If an AI tool can act across machines, it is a lateral movement path with a chat interface.

Who the third engineer was and why their machine could sign. The report says the attackers signed into the third engineer’s computer on October 29 and deployed a container. It does not describe what access that machine had, or why a container deployment token on another engineer’s laptop was enough to reach a wallet signing service. That is the control gap that turned endpoint compromise into a multi-billion-dollar transfer.

The independent review. Binance says it is engaging third-party security firms and will keep some technical details confidential. Both are reasonable. It also means the public account will remain partial for now.

The lesson that transfers

Most crypto security advice is written for holders: guard your seed phrase, check approvals, use a hardware wallet. None of that would have helped here. The victims were not asked to sign anything. Their employer was attacked through its hiring pipeline.

The transferable lesson is for anyone who works at, or interviews with, a company holding keys:

  • A coding assignment that runs on setup is code execution. Use a disposable environment, not your work laptop.
  • A recruiter who sends personal social content to build trust is running a script. Real recruiters do not need rapport props.
  • A search result for a developer tool is an attack surface. Tampered Homebrew installers and lookalike package pages are a documented pattern, and an AI coding tool is now a plausible lure because everyone wants one.
  • Endpoint detection is not a boundary. Binance’s own report says the malware was not caught at the time.
  • A deployment token is a key. Treat CI and container credentials as signing material, because in this case they were the path to signing.

Chainalysis says it has attributed more than $14.3 million in losses over the past 18 months to similar fake-interview schemes and describes them as a way for North Korean actors to refine the playbook on smaller targets (Chainalysis). The Binance case is what the same playbook looks like when the target is large enough to matter.

For the on-chain mechanics of the drain itself, see our October 30 reconstruction. For where the money went in the first 48 hours, the laundering trail is here. This piece is the part in between: how they got the keys to the building.

Sources

Frequently Asked Questions

How did the Binance attackers get in?

According to Binance's November 3 report, in June 2026 a Wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool found through a search engine. Binance detected it, replaced the device and rotated credentials, but the engineer's role and his wallet-team colleagues had been exposed. In September a second engineer was approached on a job platform, sat two fake interviews, and downloaded a coding assignment that contained malware which ran on setup. On October 20 the attackers used that machine and an internal AI tool to reach two more engineers, one of whom had a container deployment token. On October 29 they deployed a container and ran the drain.

How much has actually been frozen?

Binance's report says approximately $2.85 billion in digital assets had been frozen or intercepted as of November 3, subject to reconciliation and price changes. Earlier the company said about $3 billion was frozen on-chain. The difference is mostly timing and valuation, not a new freeze. Frozen money is also not recovered money until a court or issuer releases it.

Does 98% replenished mean users were made whole?

It means Binance has restored the backing for 98% of the affected balances using its own funds, so users can withdraw at par. It does not mean the stolen coins were recovered. The remaining 2% is less liquid tokens that Binance is still buying on the market and over the counter.

What does EIP-7702 have to do with it?

Binance says the attacker used its internal signing service to exploit EIP-7702, the Ethereum feature that lets an account delegate execution rights to a contract. That gave an attacker-controlled contract partial execution rights over a hot wallet. Because the wallet used multi-party computation, no single key could revoke the delegation, which is why containment took hours rather than minutes.

Is this the same group that hit Bybit?

The FBI attributed the Binance theft to North Korea's TraderTraitor cluster, the same group it linked to the $1.5 billion Bybit theft in 2025. Binance's report does not make its own attribution; it cites the FBI. Chainalysis says it has tied more than $14.3 million in losses over the past 18 months to similar fake-interview schemes, which it describes as a rehearsal pattern.

What should exchange users do differently?

Not much on the wallet side: the breach did not involve leaked private keys or user signatures. The practical lesson is for exchange employees, who are now a documented attack surface. For users, the risks that remain are withdrawal delays and the impersonation scams that follow them. Binance says it never charges a fee to unlock withdrawals or asks users to authorize wallet transactions to restore access.