How Binance was breached: what is known about the $6.3 billion hack

Binance's first explanation of the October 29 theft pointed to a compromised laptop belonging to one of its DevOps engineers, according to CoinDesk and CNBC. Five days later, an initial incident report described a much longer intrusion that began in June.

What Binance said first

In its first updates, Binance said the incident may have involved a compromised laptop of a DevOps engineer, which "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," CNBC and CoinDesk reported. The company said it had "found no evidence of any wallet private key leak."

The private key point matters. If keys had leaked, an attacker could sign transactions from those wallets at any time. Binance's account instead pointed to the internal systems that submit withdrawals. Co-CEO Richard Teng later described the attack as more complex than a single engineer's access, CNBC reported, paraphrasing his remarks.

What Binance's November 3 report says

In an initial incident report on November 3, Binance said the intrusion began in June, when a wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool. In September, attackers posing as recruiters put a second engineer through fake job interviews and had him download a malicious coding assignment, Fortune and SecurityWeek reported.

On October 20, the attackers used that machine and an internal AI tool to take over two engineers' computers, one of which held a token that allowed container deployments. On October 29, they deployed a container and used unauthorized access to Binance's internal wallet signing service to move funds out of hot wallets, SecurityWeek reported. Binance said it had rebuilt the affected wallet system and AI tool and replaced devices.

What the analytics firms found

Independent firms reconstructed the theft from blockchain data:

• Timing: Elliptic said the transfers ran from 20:05 to 23:56 UTC on October 29. TRM Labs said in its analysis that most of the money moved within about 20 minutes.
• Preparation: TRM said groundwork for the theft began at least 36 hours beforehand.
• Scope: TRM counted transfers across 10 blockchains; Elliptic counted 11.
• Early attribution: Before any government attribution, TRM said with "high confidence" that North Korea's TraderTraitor group was responsible. Chainalysis attributed the hack to TraderTraitor on October 30, and independent investigator ZachXBT named the Lazarus Group as the likely attacker, according to CoinDesk.

What is still unknown

Binance's report does not explain how the internal AI tool was used, SecurityWeek noted. Binance said the malware was previously unknown and was not detected by its endpoint security tools at the time.

What it could mean for traders

How the breach happened determines how quickly normal service can return and how likely a repeat is. A long intrusion through staff devices points to internal controls rather than a flaw in the blockchains themselves. The next markers are Binance's final report and the findings of the independent security firms it says it has engaged, according to SecurityWeek.

What happens next

On October 31, the FBI attributed the theft to North Korea's TraderTraitor; see the FBI's attribution. North Korea rejected the accusation.