The Binance hack that drained about $6.3 billion from the world’s largest crypto exchange on October 29 did not start that night. According to the company’s own incident report, published on Tuesday, it started more than four months earlier with a poisoned software installer, then moved through a fake job interview, a hijacked internal AI tool and three engineers’ laptops before a single coin left Binance’s wallets.
That sequence matters more than the headline number of the Binance hack. It shows how patient the attackers were, where Binance’s defences held and where they failed. It also carries a practical warning for anyone who takes a coding test from a recruiter they have never met. Below, we rebuild the timeline from Binance’s findings and from reporting by The Register, The Hacker News and Fortune.
June: one search, one tampered installer
The first foothold came in June 2026. An engineer on Binance’s wallet DevOps team, called “Engineer A” in the report, wanted to install a popular AI coding tool. He searched for it online and ended up with a tampered Homebrew installation. Homebrew is the package manager many Mac developers use to install software. Fortune reports that the fake installer was pushed through an ad campaign.
Binance’s security team caught this one. It replaced the laptop and rotated every affected credential. However, the report admits a lasting cost: “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.” In other words, the attackers lost their access but kept a map of who worked on the wallets, and that map shaped the rest of the Binance hack.
September: the interview that ended in a download
Three months later, the attackers went after a different employee, “Engineer B”. A person posing as a project director at a company that did not exist contacted him through what Binance calls a “legitimate job-hunting platform”. Fortune names it as LinkedIn and notes that his profile mentioned his work at Binance. A Binance spokesperson also told Fortune that staff in non-public roles are not supposed to keep LinkedIn profiles at all.
The first round was a live video call with a fake HR representative. To build trust, that person shared a social media account full of personal photos and videos. Binance described this as “more advanced and deceptive than previously seen social engineering approaches.” The second round then moved to a popular chat app, with someone claiming to be the fake company’s CEO. Near the end of that call, Engineer B was told to download an “assignment” onto his work computer.
The assignment was a code repository, and malicious code ran during setup. According to the report, it quietly replaced pyenv, a common Python version tool installed through Homebrew, with a lookalike that contacted a server controlled by the attackers. Because it reused a trusted tool’s name, endpoint security missed it.
October 20 to 29: from one laptop to the signing service
The attackers waited. Then, on October 20, the Binance hack entered its final stage: the intruders used Engineer B’s infected machine and a compromised internal AI tool to take control of two more laptops. One belonged to Engineer A, the wallet DevOps engineer exposed back in June. The other belonged to a wallet software engineer, “Engineer C”.
On Engineer A’s computer they found a container deployment permission token. Finally, on October 29, between 17:15 and 19:56 UTC (late night in Dhaka), they logged in to Engineer C’s laptop and used Engineer A’s stolen credentials to deploy a container. A script inside it then reached Binance’s internal wallet signing service and pushed transactions outside the normal withdrawal process. Binance has said it found no evidence that any wallet private key leaked. The keys did not need to leak, though, because the attackers controlled a service that was allowed to use them.
Who is paying for the Binance hack
Binance says customers will not lose money. In its first security incident update, the company said it would “cover all losses from the SAFU fund and the company’s funds” and that about $3 billion had already been frozen on-chain with partners’ help. By November 1 it said it had replaced roughly 95% of the affected assets. The remaining 5% are smaller, less liquid tokens that take longer to buy at scale.
The money is coming from three places: Binance’s corporate treasury, part of its futures insurance fund and its Secure Asset Fund for Users (SAFU). Here the public numbers are revealing. CoinDesk reports that the published SAFU wallet fell from about 15,000 BTC to about 7,500 BTC after four transfers on October 31. That leaves roughly $580 million, below the $800 million level at which Binance’s own rules promise a top-up. Yet those rules only cover falls in the bitcoin price, not spending. Binance has promised to restore the fund to about $1 billion, but it has not given a date.
Customers moved quickly. According to figures shared by chief executive Richard Teng and reported by CoinDesk, users withdrew $10.97 billion over a 46-hour stretch after the Binance hack, for a net outflow of $5.28 billion. By early November 3, however, hourly deposits were slightly ahead of withdrawals again.
How the Binance hack compares with Bybit
Until last week, the record belonged to Bybit, which lost about $1.5 billion in February 2025. The FBI attributed that theft to the same North Korean cluster it calls TraderTraitor. On October 31 it did the same for Binance, as AP reported. Pyongyang denies involvement.
So the new theft is roughly four times the old record. Even so, the shape of the two attacks is similar. In the Bybit case, investigators traced the breach to a compromised developer machine at Safe, the wallet software provider, rather than to a flaw in the blockchain itself. At Binance, too, the weak point was a person and a laptop, not the cryptography. Meanwhile, Chainalysis says the method was rehearsed on smaller targets. In its analysis of the case, it attributes more than $14.3 million in losses over 18 months to similar fake-interview schemes. Binance, for its part, says it has blocked 57 suspected North Korea-linked attempts so far this year.
Lessons from the Binance hack for anyone taking a coding test
Most readers will never hold a token that can move billions, so the Binance hack can feel remote. Still, the entry point here was an ordinary job hunt, and the same playbook hits freelancers and crypto holders every week. Based on what the report describes, these habits would have broken the chain:
- Never run a take-home test on a work laptop. Engineer B’s mistake was not only clicking a link. He ran stranger-supplied code on a machine with a path into production.
- Treat setup scripts as the dangerous part. The malicious code ran during installation, before any “real” test began. Use a throwaway virtual machine or a cloud sandbox, and read install scripts first.
- Be wary when an interview moves to a chat app. The second round shifted from video to messaging, where identities are harder to check.
- Verify the company, not the people. Personal photos and active social accounts proved nothing here. Instead, check company registration, a real website history and staff you can confirm independently.
- Install developer tools from official sources. Engineer A’s tampered installer came from a search, not from Homebrew’s own site.
For companies, the lesson is about standing permissions. A deployment token on one laptop and an internal AI tool with broad reach turned two infected machines into a path to the wallet signing service. That is the same pattern of trusted software being turned against its users that we saw when a hacked air alert app reached public loudspeakers earlier this week. It also lands as engineers lean harder on AI coding assistants such as Codex, the kind of tool Engineer A was trying to install.
What Binance still has not explained
The report answers how the Binance hack happened but leaves several gaps. Binance has not named the internal AI tool or said what access it had. It has not explained why a deployment token sat on an engineer’s laptop months after June’s breach, nor what the “advanced transaction-authorisation method” was. It also has not said how much of the futures insurance fund it used, or whether the frozen $3 billion will come back to the exchange.
Binance says it has rebuilt the wallet system in a new environment, replaced the affected devices, revoked the engineers’ credentials and hired outside experts to review the incident. A full technical post-mortem has been promised. Until it arrives, the clearest takeaway is uncomfortable: the largest theft in crypto history needed no broken code, just one convincing recruiter and one coding test that someone ran on the wrong computer.
