POPA ReconBinance’s Nov. 3 report says attackers used a fake recruitment process and compromised internal systems to reach wallet-signing operations. Binance describes Engineer A’s earlier compromise in June 2026, after he downloaded a tampered Homebrew installation while seeking an AI coding tool. In September, Engineer B was targeted through a fake job interview and a malicious coding assignment. On Oct. 20, the attacker used B’s compromised computer and an internal AI tool to gain control of A and Engineer C, then found A’s container-deployment permission token. On Oct. 29, stolen credentials were used to deploy a container and launch the attack. Binance’s report
Binance says the attacker abused an internal wallet-signing service and EIP-7702 authorizations to move assets from hot wallets across several networks. Its report lists 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, 18,270 BTC and additional assets, with the final unauthorized transfer of 2,961.9 ETH finalizing at 23:56 UTC. The FBI’s cited finding attributes responsibility to North Korea. Binance’s report
The forwarded $6.3 billion figure is not an accurate statement of the amount confirmed stolen: Binance calls approximately USD 6.34 billion the assets “impacted,” and says approximately USD 2.85 billion had been frozen or intercepted as of its update. It also says it had replenished 98% of impacted token assets by Oct. 31 and set aside more than 100% of funds required to cover the loss. Those figures describe impact, recovery and coverage, not the net amount stolen. Binance’s report