Binance's $6.3 billion hack of October 29 began with a fake software installer downloaded five months earlier, according to the exchange's own incident report. The report, published on November 3, reconstructs a months-long campaign that combined malware, a fake job offer and stolen credentials — a sequence that a rival exchange founder says basic workplace discipline could have prevented.

How the Attack Unfolded From June to October

The campaign began in June, when a Binance wallet operations engineer downloaded a modified Homebrew installer while attempting to install an AI coding tool. According to the exchange, its security team identified the suspicious activity, replaced the affected computer and rotated the related credentials.

Despite that response, the June incident exposed information about employees who worked on the exchange's wallet infrastructure — details the attackers used in the next stage.

In September, the attackers targeted a second engineer through a fake recruitment process and eventually persuaded the employee to download malicious software. By October 20, they had used compromised devices and an internal AI tool to reach additional engineering systems. Nine days later, stolen credentials allowed them to deploy malicious code tied to the unauthorized withdrawals.

Investigators linked the attack to TraderTraitor, a hacking unit associated with North Korea that U.S. authorities have previously linked to cryptocurrency thefts involving trojanized software and fake job offers. The FBI subsequently attributed the theft to North Korean state-sponsored attackers, while North Korea rejected the claims.

CoinEx Founder Points to Three Avoidable Security Gaps

After Binance released its report, CoinEx founder Haipo Yang argued in a post on X that the breach reflected failures in operational discipline rather than a lack of security technology.

"The Binance incident exposed at least three mistakes that were entirely avoidable: 1. Development and operations environments were not fully isolated. Anyone with production access should operate from a dedicated machine used for nothing else, with no third-party software…"

— Haipo Yang (@yhaiyang) November 3, 2026

"None of these require sophisticated technology. What was missing was discipline," Yang wrote.

His first point addressed separating work environments: employees with access to live financial systems should use dedicated computers, with coding, chat and web browsing carried out on separate devices.

His second point concerned authentication. Yang claimed that a single stolen credential could open production services without strong additional checks, and he recommended hardware security keys — physical devices built to resist phishing — and tools such as AWS Session Manager.

His third point involved multi-party computation, a setup that splits transaction signing across several participants. According to Yang, Binance's signers did not independently verify what they approved, making the system function like a single signature. "Multisig only works when the signers are mutually distrustful," he wrote.

These claims are Yang's own assessment. Binance has not publicly confirmed every weakness he described.

Binance Says It Blocked 57 North Korea-Linked Threats in 2026

Binance co-CEO Yi He said the exchange's security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. She said the techniques included fake job interviews, malicious developer tools, compromised software packages and fake video call apps. Those categories overlap directly with the June-to-October campaign, from the modified installer that began it to the fake recruitment that followed.

"Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job… "

— Yi He (@heyibinance) November 3, 2026

"We intercepted many of them, but the cost of failing to stop even one was severe," she wrote.

Asset Recovery and Next Steps

Co-CEO Richard Teng said Binance has replenished 98% of the affected assets. About $2.85 billion was frozen or intercepted, and the company has pledged to cover the full loss with corporate funds and reserves.

Binance also completed a Proof of Reserves check covering ten major cryptocurrencies, including Bitcoin, Ethereum, BNB and XRP. The check confirms asset backing for those tokens but does not show whether the gaps Yang described have been fixed.

The exchange said it has rebuilt affected wallet systems, replaced compromised devices and disabled linked credentials. It has also restored withdrawals for more Ethereum and Solana assets.

Binance plans an independent cybersecurity review along with increased spending on device protection and threat detection. It said some security measures will remain confidential so that attackers cannot identify weak points. With the financial side of the breach largely addressed, the planned independent cybersecurity review stands as the next public checkpoint on the operational questions Yang raised.

This article is based on Blockonomi's original report.