Binance hackers had weeks inside before $6.3B theft
In this article5 sections
The attackers who moved approximately $6.3 billion out of Binance hot wallets on October 29, 2026 reportedly held access to the exchange’s internal systems for about eight weeks beforehand, according to Crypto Briefing. The drain itself took roughly 20 minutes and spanned more than ten blockchains, including Ethereum, Bitcoin and Solana.
Binance co-CEO Richard Teng, speaking to CNBC, described a longer campaign that started in June, when an engineer installed a tampered version of Homebrew while looking for an AI coding tool, Coinpedia reported. The two accounts differ on the length of the intrusion: Crypto Briefing’s research points to an eight-week access window, while Coinpedia frames the operation as a months-long plot.
Key facts
- The theft began around 20:05 UTC on October 29, 2026 and most of it unfolded within about 20 minutes across more than ten blockchains.
- Binance allocated roughly $6.34 billion of corporate funds to cover the loss and said by October 31 that about 98% of stolen assets had been replenished.
- Approximately $2.85 billion to $3 billion of the stolen funds were frozen or intercepted, with Coinpedia reporting help from Tether, Circle and Ripple.
- The breach has been attributed to TraderTraitor, a North Korean state-sponsored group also linked to the $1.5 billion Bybit theft in February 2025.
- Binance has commissioned an independent security review of the breach.
How the intruders got in
Binance’s investigation traced the breach to a multi-layered social-engineering campaign, Crypto Briefing reported. Tactics included a fake job interview and tampered software development tools, which gave the attackers a path into internal systems capable of pushing unauthorized transactions. Private keys, the cryptographic credentials that control wallets, were not compromised, according to that account.
Coinpedia’s version, drawn from Teng’s CNBC interview, adds specific steps. After the June Homebrew incident, Binance spotted the activity and replaced the engineer’s device, but the team had already been exposed. In September, the attackers posed as recruiters and handed another engineer a coding test containing hidden malware, then moved through internal AI tools to reach the system that approves wallet transactions. Teng rejected the idea that a single compromised laptop was responsible. Crypto Briefing also noted internal access testing roughly 36 hours before the attack.
What Binance did after the drain
Withdrawals were paused immediately and restored in phases. The exchange drew on corporate reserves rather than customer balances to cover the shortfall, and the freeze by stablecoin issuers and partners turned a slice of the proceeds into locked tokens. Coinpedia reported that the FBI has linked the attack to TraderTraitor; Crypto Briefing described the group as tied to earlier attacks including Bybit’s 2025 loss, which the Binance figure exceeds by more than four times.
Why it matters
The case shifts attention from private-key custody to the internal approval pipeline behind hot wallets. If an intruder can operate inside the systems that authorize transfers, holding keys offline offers limited protection. The reported eight-week access window, or the longer June-to-October timeline described by Teng, puts detection rather than prevention at the center of the review Binance commissioned. The partial freeze also shows stablecoin issuers acting as an emergency brake on large thefts, a role some in crypto have resisted.
For holders, the practical point is that funds on any centralized exchange depend on that venue’s controls and reserves. Binance had the balance sheet to absorb this hit; the industry question is how many other platforms could.
What to watch
The findings of Binance’s independent security review, and any public update on recovering the remaining share of the stolen assets, are the next concrete markers. The FBI’s attribution to TraderTraitor may also bring further sanctions or law-enforcement action against the group.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: Crypto Briefing, Coinpedia
