Binance published an initial incident report on 3 November about the theft of about $6.34bn from its wallet infrastructure on 29 October. According to The Guardian and The Block, the exchange describes a campaign that ran for several months and combined malware, social engineering and the misuse of an internal AI tool, not a single breach.
The first step came in June, when a wallet engineer downloaded a tampered software package while he tried to install an AI coding tool, The Block reports. Binance replaced the device and changed the credentials, but the engineer's role and team had already been exposed. In September, attackers who posed as executives of a company that did not exist ran a fake recruitment process. A second engineer downloaded a coding assignment that infected his work computer.
On 20 October, the attackers used that computer together with an internal AI tool to take control of other wallet engineers' devices. On one of them they found a permission to deploy containers. On 29 October they used stolen credentials to deploy a container and run a script that started the wallet attack.
Binance says about $2.85bn of the stolen assets has been frozen or intercepted, and The Block reports that 98% of affected assets have been replenished. The exchange says it has closed the entry points, rebuilt or replaced the affected systems, tightened device controls and expanded AI-based detection of unusual behaviour. Withdrawals for dozens of assets started to reopen in phases on 3 November.
The FBI has attributed the attack to North Korea, which rejected the claim. Binance says it detected and prevented 57 suspected North Korea-linked attacks in 2026 and is commissioning an independent cybersecurity review of this incident.
Read the source
The Guardian ↗News publisher · 3 Nov 2026
This is an original brief based on the linked publication. Company statements and forecasts are attributed to their source.
