Binance recreates how $6.3 billion was stolen: Hacker lurked for 4 months, breached 3 computers, committed an epic-scale heist.

Binance released a preliminary investigation report on the security incident, disclosing the details of the attack and reconstructing how the hacker group breached the security defenses of the world's largest cryptocurrency trading platform—a story that could be made into a Netflix show.

In June 2026, an engineer nicknamed Xiao A from Binance's wallet operations team typed the name of an AI programming tool into a search engine. He wanted to install this tool.

The first result he found was a Homebrew installation package. He installed it.

But he didn't know that this package had been tampered with by hackers.

Binance's security team immediately detected the anomaly and urgently replaced the device, but unfortunately, Xiao A still exposed the permissions of Binance's wallet infrastructure.

The bait was set, and all the hackers had to do was wait.

From that day in June, the hackers who were about to commit the largest financial theft in history waited all summer.

In September, they got an interview with a job applicant.

The hackers posed as a "Project Director" and scheduled an interview with software engineer Xiao B on a legitimate recruitment platform. Xiao B had a strong resume, working in Binance development, and perhaps wanted a change of environment and was looking for opportunities.

The first round of the interview was a live video call. In addition to asking questions, the "HR" proactively shared their social media accounts, which contained lifestyle photos, videos, and daily life content. The conversation was pleasant.

The second round switched to a commonly used social chat app. Xiao B faced the person claiming to be the "CEO" and answered fluently. Near the end of the interview, the CEO said, "Let's do a take-home assignment." He sent over a code repository.

Xiao B downloaded it onto his work computer and began setup according to the instructions.

That 3,414-byte file was the turning point in the $6.3 billion theft case.

It bypassed Binance's endpoint security protection tools, leveraged Binance's internal AI tools, and found the marker the team had left at Xiao A's location.

Finally, on October 30, everything was ready. The hackers decided to close the net. They logged into a computer belonging to someone called Xiao C and, right under Binance's nose, took $6.3 billion.

Four months, three laptops, in exchange for $6.3 billion.