Understand this story
On November 3, 2026, Binance, the world's largest cryptocurrency exchange, suffered a hacker attack in which $6.3 billion was stolen, including a single transaction in which more than $2.5 billion was transferred out. Binance said it will bear all losses and that user funds are safe, and it has frozen about half of the stolen funds; after the hack, the platform saw net outflows of about $3.6 billion, equal to 2.1% of its $171 billion in total assets under management. On the same day, Binance released preliminary investigation results, saying that fake recruitment interviews, malicious developer software and a compromised internal AI tool together led to the theft of about $634 million in digital assets on October 29; as of October 31, 98% of the affected token assets had been restored, and about $285 million had been frozen or intercepted. Other reports said the attack began in June this year, with attackers implanting malicious code through a tampered Homebrew installer and fake interviews, and finally launching the attack on October 30 using stolen credentials.
AI-generated from public reports
Latest development · Report
Tracing the Binance $6.3 Billion Theft: Fake Homebrew Installers and Sham Job InterviewsDevelopments
2 confirmed developments
- Source:The Guardian Technology
Binance announces preliminary investigation results of hacker attack
Source:Unite.AI
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Nov 5
9to5Mac
Tracing the Binance $6.3 Billion Theft: Fake Homebrew Installers and Sham Job Interviews
Binance disclosed that in June of this year, a DevOps engineer on its wallet team downloaded a fake Homebrew installer via a search engine, which the attackers used to identify members of the wallet team; in September, another wallet engineer was asked during a fake interview to run a coding "assignment" on a work computer, and on October 29 the Binance $6.3 billion theft came to light. Binance said the first attack was intercepted in time, but it did not realize that personnel information had already leaked, and the second attack was not detected by its security team. The article notes that the malware targeted the /opt/homebrew directory where Homebrew resides on Apple silicon Macs, and mentions that the terminal paste warning introduced in macOS 26.4 has limited effect in this scenario.
Nov 4
Solidot
Binance Discloses Investigation Report on $6.3 Billion Cryptocurrency Theft Incident
Binance's official blog published a preliminary investigation report explaining how hackers stole $6.3 billion worth of cryptocurrency. The attack began in June of this year, when a wallet DevOps engineer downloaded a tampered Homebrew installer from a search engine in order to install a popular AI programming tool; in September, the attacker again impersonated a project director on a legitimate job platform, conducted two rounds of video interviews with another engineer, and implanted malicious code in the form of an assignment containing a code repository. In October, the attacker used the compromised computer and internal AI tools to control other engineers' devices, and ultimately on October 30 used stolen credentials to deploy containers and execute malicious scripts to launch the attack.
SolidotRelated discussion
Solidot joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Ayi AI NotesRelated discussion
Ayi AI Notes joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Ayi AI Notes
Binance Publishes October 29 Security Incident Report: North Korean Hackers Stole $6.34 Billion via Fake Interviews and Trojans
Binance released a preliminary investigation report on the October 29 security incident, stating that North Korean hackers lurked for four months by disguising themselves as job interviews, and ultimately transferred 233 million XRP, 970,000 SOL, 44.2 million OP, and 18,270 BTC out of 5 hot wallets, involving assets worth $6.34 billion. In the attack chain, the hackers had engineers run code repository test questions on work computers, replaced pyenv with a 3,414-byte Trojan, and used internal AI tools to scout and obtain core wallet operations permissions, then exploited the Ethereum EIP-7702 authorization mechanism to continuously drain funds. Binance said it has intercepted and frozen $2.85 billion, promised 100% full compensation for user losses, and has replenished 98% of affected tokens in its proof of reserves.
Unite.AISelected
Binance Discloses $634 Million Theft Incident: Fake Interviews and Internal AI Tool Compromised
In preliminary investigation findings published on November 3, Binance said that fake recruitment interviews, malicious developer software, and a compromised internal AI tool together led to the theft of approximately $634 million in digital assets on October 29. Binance said it will bear the losses itself, has set aside coverage funds exceeding 100%, had restored 98% of affected token assets as of October 31, and has frozen or intercepted approximately $285 million. The attackers also used Ethereum's EIP-7702 authorization mechanism to establish malicious delegations, making it impossible to immediately revoke on-chain permissions by suspending withdrawals; Binance has rebuilt the affected wallet system and internal AI tool in a new environment and will bring in independent third-party security experts for review.
Nov 3
The Guardian Technology
After Binance suffered a $6.3 billion cryptocurrency theft, how can it restore brand trust?
The world's largest cryptocurrency exchange, Binance, suffered a $6.3 billion theft, which experts believe was most likely carried out by North Korean hackers, with more than $2.5 billion transferred away in a single transaction. Binance said it will bear all losses and that user funds are safe, and it has frozen about half of the stolen funds; after the hack, the platform saw net outflows of about $3.6 billion, accounting for 2.1% of its $171 billion in total assets under management. Because countries such as the United States, the United Kingdom, and Australia do not provide cryptocurrency deposit protection, most users' losses cannot be compensated by the government.
Heat trend for this story
- Current
- 7
- Period peak
- 37 Nov 4 18:00
- 24-hour change
- -75%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.