Binance hack post-mortem: $6.34B impact, 98% replenished and a disputed CFO narrative

Binance has published initial findings, not a final independent post-mortem

Binance has now published its most detailed account of the October 29 security incident. The report answers important questions about the attack path and the exchange's response, but Binance explicitly calls it an initial report. Its investigation is continuing, an independent cybersecurity review has only been commissioned, and some technical details will remain confidential.

That distinction matters. The document is the closest thing Binance has released to a post-mortem, but it is not yet a completed, independently validated post-mortem.

Binance puts the gross impact at approximately $6.34 billion in digital assets. It says approximately $2.85 billion was frozen or intercepted, subject to reconciliation and market-price changes. The exchange says it set aside more than 100% of the funds needed to cover the loss and had replenished 98% of impacted token assets by October 31, with less-liquid assets still being purchased.

Those figures describe different things. Frozen or intercepted assets are not necessarily recovered cash, while replenishment means Binance replaced missing customer backing with its own resources; it does not mean 98% of the stolen assets were recovered from the attackers.

The attack began months before the withdrawals

Binance's current account describes a multi-stage intrusion rather than a single phishing event.

In June, a Wallet DevOps engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool. Binance says it detected that anomaly, replaced the device and rotated credentials, but the incident exposed information about the engineer's role and colleagues.
In September, another engineer was approached through a legitimate job platform and went through fake recruitment interviews. A malicious coding assignment installed previously undetected malware on the engineer's work computer.
On October 20, the attacker allegedly used the compromised endpoint and an internal AI tool as a springboard to reach two other engineers. Binance says a container-deployment token was then discovered on the DevOps engineer's computer.
On October 29, the attacker used the compromised systems and stolen credentials to deploy a container and reach Binance's internal wallet-signing operations.

Binance says the attacker then used unauthorized access to its wallet-signing service to initiate transfers outside the normal withdrawal process. Five hot wallets sent 233.46 million XRP, while other hot wallets sent approximately 970,500 SOL, 44.2 million OP and 18,270 BTC to attacker-controlled addresses.

On Ethereum, the attacker used the signing service to establish malicious EIP-7702 delegations. Those on-chain authorizations could continue moving assets after Binance suspended withdrawals and shut down normal hot-wallet services. Binance says 50 signing transactions manipulated the account nonce and established the delegations. Because the affected wallet used multi-party computation rather than a single private key, Binance had to develop a specialized revocation procedure.

The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. At 00:10 UTC on October 30, Binance says it cleared the delegation code by authorizing the zero address. The exchange continues to say it found no evidence that a wallet private key itself leaked; the failure was unauthorized use of systems able to sign and authorize transactions.

Recovery is advanced, but accountability is unfinished

Binance says it rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices, decommissioned related credentials and tokens, scanned employee devices, tightened wallet-service controls and expanded behavioral-anomaly detection.

The FBI separately attributes the theft to North Korea's TraderTraitor operation. It says the actors have been converting stolen assets primarily into ETH and expects further laundering through DeFi and instant-swap services. That attribution is an official US government assessment; Binance's report cites it, but does not independently publish evidence establishing the state actor.

Three material questions remain open:

Will the independent review validate Binance's reconstruction of the intrusion and the absence of a private-key leak?
What is the final reconciled loss after freezes, recoveries, token reissuance and price changes?
Will Binance publish enough of the review to show how signing-policy coverage and hot-wallet controls failed without creating a new security risk?

Until those answers arrive, the incident is operationally contained and customer backing is largely restored according to Binance, but the public accountability process is not complete.

Binance did not announce that it fired its CFO

The timing of Binance's finance-leadership change has generated a more dramatic claim than the available evidence supports.

Binance says Chief Financial Officer Kaiser Ng is leaving to pursue a new venture after more than five years at the company. Justin Yek, most recently vice president of finance at Airwallex, is taking over as CFO. Reuters reported co-CEO Yi He's statement that the transition plan had been implemented over the preceding six months, well before the October 29 attack.

There is no reliable report that Binance fired Ng, and neither Binance's statement nor credible coverage connects his departure to the hack. The exchange has not publicly documented when the six-month transition process began, and it has not disclosed Ng's departure date or new venture. It is therefore fair to scrutinize the timing, but not to present dismissal or breach-related responsibility as fact.

The precise conclusion is: Binance announced a CFO succession nine days after the hack, but says it was a long-planned transition. The public record does not establish that Ng was fired or that the change resulted from the incident.

Signal21's complete Binance incident coverage

The following archive collects every Signal21 Markets article published on the incident, from the first unexplained transfer through the official attack reconstruction and recovery:

October 29: detection, confirmation and containment

October 30: attack path and service suspension

October 31–November 1: attribution, replenishment and reopening

This final synthesis supersedes early estimates and theories where Binance's later disclosures provide firmer figures or a more detailed attack path. The linked articles remain a contemporaneous record of what was known, verified and still uncertain at each stage.

This publication is market analysis, not a recommendation to buy or sell.