On November 3, Binance published a preliminary report on the October 29 attack, estimating its impact at approx. $6.34 billion. According to the exchange, one stage of the preparations was a fake recruitment process, during which a developer downloaded malicious code onto a work computer.
The document, titled “Initial Findings and Response Update”, is available on the Binance blog. The exchange stresses that this is a preliminary report: the investigation is ongoing, and the findings are to undergo an independent review by external firms. Some technical details remain confidential. Binance also refers to a statement from the FBI, according to which North Korea is responsible for the attack. Earlier we wrote about the FBI identifying the perpetrators.
Months of preparation
According to Binance, this was not a single break-in or ordinary phishing, but a multi-stage campaign. In June, an engineer on the wallet infrastructure team downloaded a manipulated Homebrew installation while searching for an AI coding tool. The security team detected the anomaly, replaced the device and changed credentials, but the attackers had already learned the role of this employee and his colleagues.
In September, another developer was contacted on a job portal by a person posing as a project director. He had a video call with a supposed HR representative, who showed him her social media account to build trust. A second interview, with a fake CEO of a non-existent company, took place on a popular messaging app. At its end, the developer received an “assignment” – a code repository – which he ran on his work computer. The script replaced an element of the developer tools with a malicious one. According to Binance, security software did not detect this malware.
On October 20, the attackers used the hijacked computer and an internal AI tool to take control of the computers of two more engineers, and on one of them they found a token authorizing container launches. On October 29, between 17:15 and 19:56 UTC, they used it to run the malicious script.
Withdrawals and difficulties in stopping the attack
The first transfers started at 20:05 UTC. Within four minutes, five hot wallets sent 233.46 million XRP, followed by approx. 970.5 thousand SOL, 44.2 million OP and 18,270 BTC. The last transfer, 2,961.9 ETH, was approved at 23:56 UTC.
Halting withdrawals did not end the attack. The attackers used the EIP-7702 mechanism, granting their own smart contract partial permissions over a hot wallet. Because the wallet operated on MPC technology, there was no single private key that could be used to immediately revoke the permissions – the team had to develop a separate procedure. The delegation was removed at 00:10 UTC on October 30. We described the course of events earlier, when the exchange admitted the attack was more complex.
Of the $6.34 billion, approx. $2.85 billion was frozen or intercepted – the amount still requires reconciliation and changes with asset prices. Binance declares that it will cover the losses itself, and according to the status as of October 31, it had replenished 98 percent of the missing assets. It continues to buy less liquid tokens.
Reactions and next steps
Binance announces an independent audit, greater spending on AI-based security, and a security research fund. The attacked wallet system and the internal AI tool have been rebuilt, devices have been replaced and access credentials invalidated. By November 3, all employee devices had been scanned.
Exchange co-founder Changpeng Zhao wrote on X on Tuesday morning that an attack of this scale points to serious security failures. He added that no platform is invulnerable, but that this cannot be an excuse.
We covered the scale of customer withdrawals after the attack in our article on the net outflow of $5.3 billion.
What it means for users in Poland
The report does not indicate that customers will bear any loss – Binance states it will cover it from its own balance sheet, and the state of reserves can be checked on the Proof of Reserves page. However, the report does not separately describe the situation of Polish accounts. Withdrawal availability for a specific asset and network should be checked in the exchange panel. Binance also warned on X that as withdrawals resume, scams impersonating the exchange are increasing (private messages, emails, small transfers with an attached message) – information should only be sought through official channels.
For people looking for work in IT or crypto, the takeaway is practical: code from a “recruitment assignment” should not be run on a work computer or on a device with access to company accounts. The company and the recruiter should be verified through an independent channel.
