Binance disclosed the process of 6.3 billion dollars being stolen: hackers lurked for 4 months and breached 3 computers

The cryptocurrency exchange platform Binance released a preliminary investigation report on a security incident, disclosing the attack process in which approximately $6.3 billion in assets were stolen. The report states that an engineer, referred to as Little A, from the wallet operations team, searched for and installed an AI programming tool in June 2026, downloading a tampered Homebrew installation package from the search results. After the security team discovered the anomaly, they replaced the relevant equipment, but Little A still exposed the wallet infrastructure permissions.

The report indicates that the attacker continued to lurk thereafter. In September, the attacker contacted a software engineer, referred to as Little B, through a recruitment platform, posing as a project director, and conducted video interviews and social media interviews, sending a code repository as an assignment. Little B downloaded the repository to their work computer and set it up according to the instructions. One file of 3,414 bytes bypassed terminal security protections and used internal AI tools to find traces related to Little A.

The report states that on October 30, the attacker logged into another employee, referred to as Little C's, computer and transferred $6.3 billion. Binance stated that approximately $6.34 billion in assets were affected, with about $2.85 billion frozen or intercepted, and the losses covered by the SAFU fund and company funds. As of October 31, 98% of the affected tokens have been replenished.