BINANCE - BIGGEST HACK EVER, $6.3 BILLION WORTH OF ASSETS STOLEN [UPDATED]

[Chibit01]

It’s been a while since I’ve used any CEXs, but I found it quite impressive that there weren’t any mass withdrawals on Binance

I remember that there was once a mass withdrawal like that, and Binance withstood the test

Over the last 24 hours there has been a sizable outflow of $3.5 B and over the last week's $14.1 b this is enough to say there has been a mass withdrawal from Binance.
- https://x.com/Cointelegraph/status/2117351157274206345

Another report shows Binance deposit for the past few hours exceed their number of withdrawals, which claims people still have faith in the exchanges, with the majority of the withdrawals going to self-custody and only 6–7% going to other centralised exchanges (according to Cz_binance), which I will say it's too quick to calculate the outflow and inflow when withdrawal is not fully enabled in all the network.

https://x.com/coinbureau/status/2117508353538818544?a=eNuc84MZyacdvtRa6Gw&s=19

[greysonz]

Binance says attackers compromised an employee device using a fake job interview

https://x.com/WatcherGuru/status/2117626987040907770?a=VtI2tqCsKYWzcYsrX3g&s=19

Well...

[Cookdata]

Another report shows Binance deposit for the past few hours exceed their number of withdrawals, which claims people still have faith in the exchanges, with the majority of the withdrawals going to self-custody and only 6–7% going to other centralised exchanges (according to Cz_binance), which I will say it's too quick to calculate the outflow and inflow when withdrawal is not fully enabled in all the network.

https://x.com/coinbureau/status/2117508353538818544?a=eNuc84MZyacdvtRa6Gw&s=19

Saw the report too, the details doesn't make any sense. How can few hours of deposit be used to judge what has happened in the last 2 days. It's more like PR to make users have a change of mind. Why would users withdraw their money and then the second day they start depositing back to where they left. It's not adding up unless this is Binance doing the deposit on chain and want to make people look stupid to restore confidence.

Binance says attackers compromised an employee device using a fake job interview

I thought this is a basic security tips of devs, most devs don't use their sensitive device for daily activity. The more I read about this Binance hack, I think they don't know exactly what happened and they have to conclude that it was an employee laptop that was comprised. Like you mean somebody that is part of the Binance billions of dollars wallets can't afford a separate laptop for job interview. I feel we are getting insulted with the outcome of the hack analysis.

[Emjay24]

Binance gives security incident, initial findings and response update on the attack

Attack Preparation
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.
June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.
Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.

https://x.com/binance/status/2117626126214504729

[Chibit01]

Another report shows Binance deposit for the past few hours exceed their number of withdrawals, which claims people still have faith in the exchanges, with the majority of the withdrawals going to self-custody and only 6–7% going to other centralised exchanges (according to Cz_binance), which I will say it's too quick to calculate the outflow and inflow when withdrawal is not fully enabled in all the network.

https://x.com/coinbureau/status/2117508353538818544?a=eNuc84MZyacdvtRa6Gw&s=19

Saw the report too, the details doesn't make any sense. How can few hours of deposit be used to judge what has happened in the last 2 days. It's more like PR to make users have a change of mind. Why would users withdraw their money and then the second day they start depositing back to where they left. It's not adding up unless this is Binance doing the deposit on chain and want to make people look stupid to restore confidence.

If Binance is actually faking the deposit, then they are making the worst mistake. It's natural for exchanges to decline on deposit and have a high withdrawal after a hack. How transparent they are will determine if people will trust them or not, as some have started discovering the importance of securing their own assets under their own full control.

A tweeter user also posted the below image referencing FTX.

[Dogedegen]

Saw the report too, the details doesn't make any sense. How can few hours of deposit be used to judge what has happened in the last 2 days. It's more like PR to make users have a change of mind. Why would users withdraw their money and then the second day they start depositing back to where they left. It's not adding up unless this is Binance doing the deposit on chain and want to make people look stupid to restore confidence.

Unless you have proof that it is PR, it is not. Do not make grand claims based on nothing, it is a a very bad thing to do. Big claims require very big evidence.

If Binance is actually faking the deposit, then they are making the worst mistake. It's natural for exchanges to decline on deposit and have a high withdrawal after a hack. How transparent they are will determine if people will trust them or not, as some have started discovering the importance of securing their own assets under their own full control.

A tweeter user also posted the below image referencing FTX.

This is the kind of evil internet stuff that I am talking about, and it is one of the big reasons why we can't have good things. When people act correctly and deal with negative situations like this in the best way possible, users still abuse this and give them crap for it. This is why more and more companies and CEOs will continue to act in worse and worse way. We should give credit where credit is due, and learn to put bias and negativity aside that has been deeply programmed by internet algorithms into most users.

Binance gives security incident, initial findings and response update on the attack

Attack Preparation
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.
June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.
Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.

https://x.com/binance/status/2117626126214504729

If users were to focus on getting some knowledge instead of being quick to judge we would all live in a better world. Most that reacted negatively do not even know how a hacking chain is done, or the value of simply learning some information in some compromise. How many concluded so fast that a single devops engineer is able to sign off on billions worth of transactions is stunning. Great update!

[PrivacyG]

I find it really unbelievable that the best way to get some supposedly smart people scammed is STILL through Malware and such.  The old, boring ways.  I have not had any of my devices infected in about two decades and all I have to do is make sure I know what I want to download is the same thing that I am actually downloading, or opening or what ever.

Browser extensions, Software packages, popular developer tools.  Do most of these not have ways of verifying whether they are legitimate or not?  Should they not know about this already and stop opening random PDF files, executables and what ever else they opened that was infected?

It is worrying to see the most basic types of attacks succeed at such a high level where for these people they should be the easiest to avoid.

[macson]

Binance says attackers compromised an employee device using a fake job interview

If they say that, it means their security level is far lower than the garment factory near my house, which has strict procedures regarding its employees' devices.

It's so funny because how is it possible that a company that big has such a low level of security and how can an employee have that much power to move $6B.

Unless that 'employee' is this person:

[Dogedegen]

I find it really unbelievable that the best way to get some supposedly smart people scammed is STILL through Malware and such.  The old, boring ways.  I have not had any of my devices infected in about two decades and all I have to do is make sure I know what I want to download is the same thing that I am actually downloading, or opening or what ever.

Browser extensions, Software packages, popular developer tools.  Do most of these not have ways of verifying whether they are legitimate or not?  Should they not know about this already and stop opening random PDF files, executables and what ever else they opened that was infected?

It is worrying to see the most basic types of attacks succeed at such a high level where for these people they should be the easiest to avoid.

I don't remember being infected since the Limewire days. I think there are two major things at work here. The first is that developers or engineers do not usually have security knowledge. Often they don't even have systems knowledge, they just build build build and crypto has this stupid thing of build fast as possible. It is not true for the devops engineer but we are talking about bigger things.

The second is attack interest. You and me are not important and probably not even public people. The interest to hack Binance is huge, and the best way to start the attack chain would be to attack the employees. So you can just imagine for the year 2026 how many attacks targeted specifically Binance employees. I don't know about you, but I had zero targeted attacks on me since I joined the internet. I think that is what makes the difference. If you look into the story of fake job offers, they really try to play the game. First fake interview with HR, second with a technical member or someone else so they try to simulate the whole thing to look and feel reel. The more steps happen that look real it makes your subconscious doubt less and less until eventually you make some mistake.

But what I must criticize is running any interview or coding challenge download on your system, that there is no understanding for. It should only be done in a virtual machine that is deleted after the test is over.  There is no excuse for this because it takes minutes of passive work to clone the machine.

If they say that, it means their security level is far lower than the garment factory near my house, which has strict procedures regarding its employees' devices.

Again false judgement, criticism and malice. This is the most common way that all companies get hacked..

It's so funny because how is it possible that a company that big has such a low level of security and how can an employee have that much power to move $6B.

You didn't read a single post here.  

[Myleschetty]

It was reported by Onchain Lens a few hours ago that the hacker involved in the Binance hack have started using mixing tools to handle the stolen funds, and around $800,000 has been mixed so far. The address associated with the hack deposited 8,567 SOL tokens, worth around $798,000, into the Privacy Cash privacy mixing tool on the Solana blockchain.

https://x.com/OnchainLens/status/2117667980758995211?s=46

[alani123]

Seems like reliable sources are now reporting that the access to binance funds happened after an employee dowloaded a poisoned interview file on his work laptop and therefore the hackares were able to access critical infastracture that the work computer was connected to:

https://www.washingtonpost.com/technology/2026/11/03/how-malware-bogus-job-interview-let-attackers-nab-63b-binance/

This is less sophisticated than what was speculated.

Binance allowed its employees with high level access to run executable files on their machines, which led to a direct compromise.
When a call center handling pennies  can safeguard their computers better than an exchange handling billions of people's funds, something goes very wrong with their cybersecurity infrastructure.

[suzanne5223]

Kim Yo-jong, a director in the Central Committee of the Workers' Party of North Korea, released a second statement concerning the Binance hack, indicating that North Korea is open to dialogue, although this may not be in the best interest of the nation.

Kim Yo-jong is the sibling of North Korean leader Kim Jong-un. Previously, she condemned the United States for attributing the $6.3 billion Binance security breach to North Korea, even as they assert they bear no responsibility for the hack.
https://www.panewslab.com/zh/articles/01a1a408-53a4-75d2-89ba-fa15add3c896

[ultrloa]

I love how the narrator explain the recent heist happened on Binance, then discussed about the methods done by exploiters to possibly move the money out on that exchange.

Watch it here https://web.facebook.com/share/v/19KVQ95m5q/

To many things happened in short period of time. Hackers really tried their best to act fast in this incident.

[PostQuantumBTC]

THORChain has resume swapping function after a refund bug was exposed. The hacker that stole cryptocurrencies on Binance has been making use of the service to launder solana which was among the coins that were stolen.

https://cointelegraph.com/news/binance-hackers-move-81-stolen-solana-route-thorchain

The swapping function resumed yesterday, the hackers have used it not long after the swapping function resumed.

[DubemIfedigbo001]

44.23M OP worth $4.8M also been recovered from the Binance hack.

After the @arbitrum Security Council took action, @Optimism has now recovered 44.23M OP (~$4.8M) from the @binance attacker

On Oct 31, Optimism's Security Council upgraded the code of the bridge contract linking Ethereum and OP Mainnet. This let them move the attacker's OP without the attacker's approval, sending all 44.23M OP to an address controlled by Optimism. The original code was put back in the same transaction

Transaction reference https://optimistic.etherscan.io/tx/0x120aa6c2e6dac40c0795cace7db7dc8bc09465630c42d271847fc33d2e32bed7
DIAGRAMATIC REPRESENTATION

Source


Binance in it's recent update says they've replenished 98% of the stolen amounts and have updated their proof of reserves to contain 44 tokens.

We have now replenished approximately 98% of the impacted amount, and we continue to buy the remaining token assets through market and OTC channels. Purchases for the remaining 2% are expected to be slower because these tokens are less liquid. We will continue to provide further updates.
We have also taken a new Proof of Reserves (PoR) snapshot at 2026-11-04 00:00 (UTC). It now covers 44 tokens, up from 10 in the previous snapshot

You can check for their proof of reserves Here
Source

[Bitcoin_Arena]

Binance says attackers compromised an employee device using a fake job interview

I thought this is a basic security tips of devs, most devs don't use their sensitive device for daily activity. The more I read about this Binance hack, I think they don't know exactly what happened and they have to conclude that it was an employee laptop that was comprised. Like you mean somebody that is part of the Binance billions of dollars wallets can't afford a separate laptop for job interview. I feel we are getting insulted with the outcome of the hack analysis.

This is why I never always rule out the possibility of insider jobs. I mean, this is $6 billion or even more that we are talking about. How many Binance devs can make that much in their lifetime?
Why not just pretend to be a victim of a cyberattack and use other third-party folks to withdraw the funds into different addresses and launder it? Blame it on some hackers in North Korea and share the spoils while the world thinks that it's actually North Korea that orchestrated the heist.

[Dogedegen]

44.23M OP worth $4.8M also been recovered from the Binance hack.

After the @arbitrum Security Council took action, @Optimism has now recovered 44.23M OP (~$4.8M) from the @binance attacker

On Oct 31, Optimism's Security Council upgraded the code of the bridge contract linking Ethereum and OP Mainnet. This let them move the attacker's OP without the attacker's approval, sending all 44.23M OP to an address controlled by Optimism. The original code was put back in the same transaction

Transaction reference https://optimistic.etherscan.io/tx/0x120aa6c2e6dac40c0795cace7db7dc8bc09465630c42d271847fc33d2e32bed7
DIAGRAMATIC REPRESENTATION

Source

The upside of centralization or fake decentralization when they pretend with DAOs and stuff like that. It is very useful in situations like this and can be handled after the fact in account-based systems because you don't need to revert the chain but then it comes with a huge price to pay. The same tools can be used for all kinds of things, freezing, AML, and so on. The price of real decentralization like with Bitcoin is that we can't do anything directly to recover the funds. Mostly recovery depends on errors made by attackers in the future. If they bide their time and do things right, recovery is basically impossible. Cases that are not high profile are completely lost. I am sure most of us will agree that this is a good price to pay, but unfortunately from what I see how users comment they really do not understand decentralization and some don't want it. Repeating the word of something does not mean we understand it..

[omegaelite]

I made a 4-minute animated explainer of how this happened, based on Binance's Nov 3 incident report: https://youtu.be/nFJpnXBYETc (disclosure: it's my channel).

Summary of the chain Binance described (AI-generated, checked against Binance's report and the sources below):
- June: a wallet DevOps engineer looking for an AI coding tool installed a tampered copy of Homebrew. Binance caught it, replaced his laptop and reset his passwords, but says his role and his teammates on the wallet team had been exposed.
- September: a teammate, a wallet software engineer, was approached on a real job site by a fake "project director", then interviewed by a fake HR person and a fake CEO. Setting up the coding assignment on his work computer replaced pyenv with a copy that took commands from the attackers' server, and Binance's security software missed it.
- October 20: from that computer, and through one of Binance's internal AI tools, they took over two more engineers' computers, including the first engineer's new laptop, which held a container-deployment token.
- October 29 (17:15 to 19:56 UTC): logged into the other computer, they used that token to launch their own program inside Binance. It reached the signing service and created withdrawals outside the normal approvals. The drain itself started around 20:05 UTC.

Binance hasn't said what the attackers did with what they learned in June, or exactly how the AI tool was used.

Sources: Binance's incident report (https://x.com/binance/status/2117626126214504729), BleepingComputer (https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/), CoinDesk (https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says)

[Ashawowo(OS)]

Binance has removed all Signal Plus APIs as an immediate precautionary measure due to a security vulnerability reported. All affected users were advised to log into Binance directly and review their positions. There's no report of users fund lost. Users are advised to wait until Signal Plus rectifies the issue before they bind their API keys again. Binance also directed that all third party providers should check their security architecture properly to ensure there are no vulnerabilities that could impact customers.

Read more Here

[PrivacyG]

But what I must criticize is running any interview or coding challenge download on your system, that there is no understanding for. It should only be done in a virtual machine that is deleted after the test is over.  There is no excuse for this because it takes minutes of passive work to clone the machine.

This is the best summary.  An employee who has access to keys that may lead to damage if compromised should never use that device for ANY OTHER THING than what it was destined for.  You get employees who download and run things on that computer, you get very unnecessary risks!  I would not even do that on a Virtual Machine, I would do it on a completely separate computer.

The only situation I would MAYBE consider using a Virtual Machine was if I was running Qubes on that laptop.  Then I would create a new qube and purge it after the interview.

-----

I am curious how many Billionaires there currently are out of Cryptocurrency scams?  There are only about three thousand Billionaires in the World.  If the number rises up to 30 'Billionaire scammers' then they would make a total of 1 percent, and I believe we are soon going to be a quarter there already!