An onchain trace by Unchained showed 7,500 BTC that left Binance’s SAFU emergency reserve on Oct 31 moved again on Nov 3 to an unlabeled high-volume address, which subsequently sent 4,800 BTC in a single 9,346 BTC transaction, leaving the fund with about $583 million in bitcoin. The transfers came as Binance reported it has replenished 98% of the $6.34 billion in tokens affected by the Oct 29 breach using its SAFU reserve and corporate balance sheet without borrowing or selling assets, while $2.85 billion—or 44% of the stolen funds—has been frozen or intercepted across 11 blockchains.

In its preliminary investigation report, Binance traced the heist to a multi-month campaign that began in June when a wallet DevOps engineer downloaded a tampered Homebrew installer while setting up an AI coding tool; although Binance replaced that device and rotated credentials, the attackers mapped out members of the wallet team. In September, a second engineer downloaded a malicious coding assignment onto a work computer during a fake job interview, allowing hackers on Oct 20 to use an internal AI tool to compromise two other wallet engineers, steal a container deployment token and access the wallet-signing service on Oct 29. The attackers also exploited Ethereum’s EIP-7702 authorization mechanism so transfers continued for about four hours even after withdrawals were halted. Co-founder Yi He said Binance had blocked 57 suspected North Korea-linked cyber threats in 2026 before the breach, adding that “the cost of failing to stop even one was severe.”