Security
Binance’s Second Account Moves the Start of the $6.3 Billion Breach to a LinkedIn Message
Binance’s first statement pointed at a DevOps engineer’s laptop. Its November 3 account, as reported by Fortune, starts with a different engineer, a fake recruiter and a tampered Homebrew download. Meanwhile the stolen bitcoin has not moved.
When this desk reported the Binance theft on October 30, the open question was how one compromised workstation reached signing authority on ten chains. Binance’s first statement, as relayed by CoinDesk, said a DevOps engineer’s laptop “may have” let an attacker submit unauthorized withdrawals. Its account of November 3 is longer, and it begins somewhere else.
This desk has not read the November 3 post itself. What follows is Fortune’s report of it, and Fortune does not link the original. Where the two accounts differ, this story says so.
What Binance now says happened
According to Fortune, a person posing as a “Project Director” contacted a Binance engineer, which Binance labels Software Engineer B, on LinkedIn; the profile mentioned Binance experience. A first-round interview with a purported HR representative followed, then a second with someone claiming to be the CEO of a fictitious company. The engineer was persuaded to download an “assignment,” which let the attackers into company systems.
A second route ran in parallel. Another engineer clicked an internet ad for a tampered version of Homebrew, the open-source package manager, instead of using the company’s normal channels. Fortune reports that Binance detected and removed the fake download, but not before the attackers learned that engineer’s role and who else managed company wallets.
Binance’s two accounts, side by side
| Question | Oct 29 (via CoinDesk) | Nov 3 (via Fortune) |
|---|---|---|
| First machine | A DevOps engineer’s laptop, “may have” | Software Engineer B’s laptop |
| How it began | Not stated | Fake recruiter, two fake interviews, a downloaded “assignment”; a tampered Homebrew ad |
| Route to signing | A service container | Control of two wallet engineers’ accounts, one holding a container deployment token |
| Attributed to | No one | North Korea (FBI attribution to TraderTraitor, per Elliptic) |
How the pivot worked, and the AI claim
Per Fortune, the attackers used Engineer B’s compromised laptop and an internal AI tool to take over the accounts of “Wallet DevOps Engineer A” and “Wallet Software Engineer C.” Engineer A had a container deployment permission token on his computer. Combined, that access let the attackers take over a series of Binance wallets and drain them.
Binance says the attack relied mainly on conventional phishing, and that AI played a part only after the first laptop was compromised. The article does not say what the internal AI tool did or what access it had, and this desk cannot fill that in. Binance also told Fortune it detected and prevented 57 North Korea-related attempts in 2026, a figure no outside party has checked.
Two details remain unexplained in the account as reported. It does not say how the signing capability reached ten chains with different key schemes, the question this desk raised on October 30. And it does not reconcile the first statement’s DevOps laptop with a story that starts with Engineer B. The two can both be true, since Engineer A’s access was reached through B, but Binance’s first statement did not say so.
A Binance spokesperson told Fortune that employees in non-public-facing roles may not maintain LinkedIn profiles. The spokesperson would not say whether Engineer B broke that rule or whether either engineer would be dismissed.
Where the money is, per Elliptic
Elliptic’s update, timestamped 08:00 UTC on November 7, counts $6.43 billion stolen, about $2.85 billion frozen or seized (44%), and about $3.13 billion still sitting in theft-linked addresses, mostly ETH and BTC. The 18,270 BTC taken has not moved. About 2,300 BTC (roughly $175 million) now sits in new addresses, converted from other stolen assets, up from about 1,650 BTC a day earlier. Only about $3 million of $1.34 billion in stolen ETH has moved, and the nine largest ETH addresses, holding 89% of it, have been still since October 30.
XRP is where the laundering is loudest. Elliptic says about $100 million has been swapped, mostly into bitcoin, with about $173 million left. It also counts more than 20,000 wallets on 16 chains, at least 36 services and at least 65,000 transactions. Elliptic says the process looks automated but it has seen nothing showing an AI agent making decisions. Elliptic sells blockchain analytics, and its write-up promotes those products; its conclusions are its own assessment, and its figures differ internally in places, as it notes.
The knock-on effects
Sentora, as reported by crypto.news, found the DeFi aftershock far smaller than April’s $292 million Kelp DAO exploit: $1.59 billion in net lending outflows in a day, about 3% of lending TVL, with roughly 60% back within three days, against $10.9 billion over five days for Kelp. Sentora’s two windows differ, which flatters neither comparison. crypto.news also reports that Binance, on November 5, asked Arbitrum’s DAO to return 8,425.997 ETH and 74,559,805.2 ARB, and expects the process to take about 49 days. This desk has not seen that request itself.
The Take
The account is believable on its face and consistent with a pattern governments have already described. It is still a company’s account of its own failure, relayed secondhand. The test is the promised technical post-mortem: whether it names which control should have stopped a container deployment token on one engineer’s machine from reaching ten chains, and whether anyone outside Binance reviews it.