The attack on Binance involving the withdrawal of $6.34 billion became possible not because of a vulnerability in the code, but because of months-long work by the attackers with exchange employees. This conclusion follows from an analysis of the platform's report, examined by Asylbek Aitmatov, Chairman of the Expert Council of the Association of Virtual Asset Market Participants (AURVA).

How the attackers reached the exchange

The chain of events stretched over several months. First, in June, a trojanized installer of Homebrew — a popular package manager for developers — came into play. In September, the attackers conducted a fake job interview with an engineer. The denouement came on October 29 — in a single evening, $6.34 billion was withdrawn from the exchange.

"Months of patient work with people, not with servers," is how Aitmatov described the attackers' approach.

This leads to the first conclusion: the exchange's security perimeter now also runs through its engineers' resumes. A profile on a job site, a "test assignment" from a nonexistent employer, or a link in search results to an infected program becomes a threat. Protection here is provided by four elements:

  • strict access management;
  • a second signatory on critical operations;
  • employee training;
  • segmentation of systems so that infection of a single laptop does not open the path to transaction signing.

The second observation concerns artificial intelligence. AI did not hack the exchange, and such a version should not be spread. However, according to Binance's report, the attackers used the company's internal AI tool to reach other employees. Every AI agent with access to systems is an additional entry point. This applies to all companies that are currently hastily implementing AI.

What changed for clients

The main consequence for users is lost time. The exchange compensated the losses, but withdrawals were closed for about 48 hours, and access to some assets is still being restored in stages. For a business that settles through the exchange, two days without money is already a loss, even with full reimbursement.

Aitmatov also drew attention to the compensation mechanism. Binance covered the losses from its own funds and a reserve fund. This fund is often called insurance, but that is not the case. The reserve pays out by decision of the company itself, while insurance pays out under a contract, with exclusions and timelines. Clients should find out in advance what reserve the platform has and on what terms it operates. Most exchanges have no such reserve.

The expert found no evidence that Binance is hiding anything. The attack report was released on the fifth day, the exchange updates its Proof of Reserves — public confirmation that client assets are backed — and the restoration of withdrawals is proceeding openly. Binance founder Changpeng Zhao (CZ) himself called some of the details awkward. At the same time, this is a self-report. The company is only promising an independent audit, and the market should wait for exactly that, as well as clarity on the fate of $2.85 billion in frozen assets.

The expert called the risk for other platforms systemic. The FBI linked the attack to the same North Korean group that was behind the Bybit hack in 2025, and the industry's tools are shared. But a hack is not a death sentence. According to Binance, this year it repelled 57 similar attempts.

"They only talk about the one that got through," concluded Asylbek Aitmatov.

Cryptalist analysis: The incident shifts the focus of exchange risk assessment from technical audit to the human factor and operational resilience. Compensation of losses does not eliminate reputational and institutional vulnerability: the market requires independent verification of reserves and transparency regarding frozen funds, otherwise trust in centralized platforms will remain conditional.