# Binance traces hack to fake job interviews > Binance says a poisoned Homebrew install and a fake interview led to the Oct. 29 hot-wallet theft. Near $2.85 billion is frozen or intercepted, and 98% of affected tokens were refilled. - **Source:** https://ptycoin.com/en/posts/2026-11-03-binance-initial-findings-attack-path-nov3/ - **Published:** 2026-11-03 - **Category:** News - **Author:** Mateo - **Tags:** exchanges, security, binance - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-11-03-binance-initial-findings-attack-path-nov3/) --- [Binance](https://x.com/binance/status/2117626126214504729) says attackers reached the service that signs its hot-wallet transactions on 29 October after two earlier breaks: a poisoned Homebrew install in June and a fake job interview in September. A hot wallet is an online wallet the exchange keeps funded so it can send coins quickly. Homebrew is a tool Mac developers use to install software. ## A doctored Homebrew install in June In June an engineer on the wallet DevOps team searched for a widely used AI coding assistant and downloaded a Homebrew installer that had already been altered. Security staff noticed, gave him a new computer, and rotated the logins on the old one. The exchange says his role, and the coworkers beside him on the wallet infrastructure team, stayed visible to the intruders. ## Interviews on a real job board A second opening came in September. That engineer had a profile on a genuine hiring site that mentioned his time at Binance. A stranger there, using the title of project director, set up two conversations. The first was a video call with someone playing recruiter, who shared a social account full of personal photos and videos. The second, in a common chat app, was with someone introduced as the head of a company that does not exist. At the end of that second call he was told to copy a code repository onto the company laptop and treat it as the test. During setup the repository swapped a normal developer tool for a hostile stand-in that could run commands and phone a server the intruders controlled. Binance says its endpoint tools had never seen the program, so they missed it, and that the intruders then tried to wipe the traces. According to [CoinDesk](https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says), Richard Teng told reporters the attack "was a campaign, built over many months." ## An internal AI tool on 20 October On 20 October, Binance says, the intruders moved from the September laptop through an internal AI tool onto two more machines: the June DevOps engineer and a second wallet software engineer. On the DevOps machine they found a token that could deploy containers. On 29 October they used the second engineer's computer from 17:15 until 19:56. With the token from the DevOps machine they launched a container and a script against the internal service that signs wallet transactions. ## Outflows, then EIP-7702 Binance times the first coins leaving at 20:05 UTC. In the next four minutes, five hot wallets moved 233.46 million XRP to an address the intruders held. Wallets on Solana and Optimism sent roughly 970,500 SOL, along with 44.2 million OP. An internal alarm on the size of those transfers put staff on the case. A bitcoin wallet then moved 18,270 BTC, figures also laid out by [CryptoBriefing](https://cryptobriefing.com/binance-attacker-compromised-computer-ai-tool/). The signing service was next pointed at Ethereum's EIP-7702. That rule lets an account grant a smart contract limited power to act for it, and the private key stays put. The contract belonged to the intruders, and the grant covered one Binance hot wallet. Fifty signing transactions advanced the account nonce, the counter that orders its transactions, until the hostile delegation was on the chain. Later sends could skip the usual withdrawal path. Pausing withdrawals and taking the hot-wallet service offline left those on-chain grants in place. Partners were asked to freeze tokens. Clearing the delegation was slow because the hot wallet uses multi-party computation, so nobody holds one key that can cancel the grant. Staff built and ran a procedure for that case. The last send the exchange marks as unauthorized, 2,961.9 ether, landed in a block at 23:56 UTC after sitting pending. At 00:10 UTC on 30 October, a new authorization from the hot wallet labeled Binance14 to the zero address cleared the delegation. ## The freeze and the refill Binance's update puts assets involved near $6.34 billion and the frozen or intercepted portion near $2.85 billion, a sum that can still move with reconciliation and prices. As of 31 October, 98 percent of the affected tokens had been refilled, visible on the proof-of-reserves page. The reserve set aside is larger than the loss. Buying continues for the less liquid tokens still missing. The loss sits with Binance, not with users. Binance, citing the latest FBI release, says the bureau indicates North Korea is responsible. PTYcoin's report on that attribution is [here](/en/posts/2026-10-31-binance-fbi-tradertraitor-oct31/). ## Repairs underway By 3 November, Binance says, it had stood the affected wallet software up again in a separate environment, rebuilt the internal AI tool and its access rules, swapped the machines involved, and retired the logins and tokens on that path. Staff devices were scanned again. AI checks for odd behavior were widened, and controls on the wallet service were tightened. Outside cybersecurity firms are coming in to review the break-in and the exchange's own findings. It is adding budget for AI detection, endpoint defense, and developer machines, and it is working on a research fund with AI companies and security firms. --- ## Keep reading - [Is SMS 2FA enough to protect your crypto exchange account? The text code follows your phone number, and a SIM swap or port-out can move that number before the authenticator app, the withdrawal allowlist, and the anti-phishing code are on](https://ptycoin.com/en/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/index.md): SMS codes follow the phone number, so a SIM swap can take them. Switch to an authenticator or a passkey, turn on a withdrawal allowlist, and set an anti-phishing code. - [What is a destination tag or memo? On XRP, Stellar, Cosmos and similar networks the receive address alone is not enough, and a missing or wrong tag is how exchange deposits look confirmed on-chain while the desk never credits you](https://ptycoin.com/en/posts/2026-09-22-destination-tag-memo-exchange-deposit/index.md): Your exchange deposit needs both address and destination tag or memo. Miss either and the chain can confirm while your balance never updates. Copy both, check twice, then send. - [Self-Custody 101: Moving Your Crypto Off an Exchange Safely](https://ptycoin.com/en/posts/2026-06-05-self-custody-101-moving-crypto-off-exchange/index.md): Take control of your cryptocurrency. This step-by-step guide shows beginners how to safely move crypto from an exchange into a hardware wallet you control, with concrete checks that prevent the most common — and costly — mistakes. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-11-03-binance-initial-findings-attack-path-nov3/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/