What Does Binance Say Happened?
Binance’s report, as summarized by Tokenist, describes four stages:
- June: an engineer looking for an AI coding tool clicked an ad for a tampered copy of a developer tool. Binance caught it and rotated credentials, but the attackers had already learned who ran the wallets.
- September: a second engineer was approached by a fake recruiter and given a coding assignment containing malware that security tools missed.
- By Oct. 20: the attackers used an internal AI tool to take over two engineers on the wallet team. One had a deployment token on their machine.
- Oct. 29: the token let them deploy a malicious script, reach the wallet signing service, and move funds across several chains.
Plain English: no one broke Binance’s cryptography. The attackers got a trusted employee’s access and used it to approve transfers. Co-CEO Richard Teng rejected the single-laptop explanation that Binance gave on Oct. 29.
Where Is the Money?
Binance says $2.85B has been frozen or intercepted, much of it stablecoins Tether and Circle could lock. Elliptic counts about $3.24B still in attacker-linked addresses. Binance also published a zero-knowledge proof of reserves for an Oct. 31 snapshot, which lets holders of ten tokens verify backing. A second snapshot covering more tokens was planned.
Why Are Some Traders Skeptical?
The story shifted from one laptop to three engineers, and the money left across ten chains in about 20 minutes. Critics also point to the June warning and to the size of the hot wallets. The Oct. 31 reserves snapshot was taken after most stolen assets had been replaced, so critics say it can’t show the size of the hole.
The other side: a compromised employee laptop doesn’t make it an inside job. Fake job offers with booby-trapped coding tests are TraderTraitor’s best-known method. Binance co-founder Yi He called one viral claim untrue. No evidence of insider involvement has been published, and North Korea has denied involvement.
Why It Matters
Binance’s account makes an internal AI tool a stepping stone into its wallet team, if the report holds up. That is a new attack surface for exchanges adopting AI, and it fits our AI-security series. The test now is the independent review and whether the second reserves snapshot holds up.
