Binance's June device reset preceded a second September breach, Teng tells CNBC

What happened after the June detection

CNBC reports that the preparations began in June. A Binance Wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool found through a search engine. The account comes from Binance's preliminary security report, as described by CNBC. It is the exchange's reconstruction of the incident, rather than a published independent forensic finding.

According to that account, Binance identified suspicious activity, replaced the engineer's device and rotated credentials as a precaution. By that point, however, the attacker had learned about the engineer's role and related colleagues in the wallet-infrastructure team. The report therefore places both a detected compromise and a residual exposure in June. A reader should keep both parts of the account when judging the response.

The exposed relationships are relevant because Teng describes another employee being approached later. They do not prove exactly how an attacker chose every subsequent target. CNBC's article does not provide a complete device-by-device record, and it does not establish whether each internal contact was obtained from the original machine. Those missing details prevent a more specific reconstruction.

For an exchange customer, the useful question is what the investigation establishes about authorization and containment. Knowing that a machine was replaced answers one part of that question. An independent review would need to examine the later access as well. This is our interpretation of the sequence Teng described, without attributing a particular control failure to a named employee.

September brought a separate approach

Teng told CNBC that attackers posed as recruiters in September and conducted a series of interviews with another engineer. A coding exercise contained hidden malware designed to evade security, he said. He described attackers then moving through internal AI tools and obtaining access that breached the system authorizing wallet transactions. Teng's account to CNBC.

The months in this account give the incident a longer preparation period than a description centered on the October theft alone. June and September refer to earlier access attempts. October 29 is the date CNBC gives for the theft. These dates identify different stages, so they should remain attached to their respective actions when comparing headlines and later updates.

Teng rejected the suggestion that one employee's laptop was the single point of failure. That is his characterization. The reporting supports a sequence involving multiple employee devices and internal tools; it does not supply enough technical evidence to decide how many independent authorization barriers were present or which barrier failed first.

PANews separately summarizes the preliminary investigation as a progression through fake interviews, tampered Homebrew packages, multiple devices and the internal wallet-signing service. It attributes its account to Reuters and Binance's report. Its summary corroborates the broad sequence but adds no independent forensic audit of the June response. PANews's preliminary-report summary.

The AI reference has a specific place in the account

CNBC describes internal AI tools as part of the route toward wallet authorization. The report also says the first engineer was seeking an AI coding tool when the tampered installation was downloaded. These are separate references to AI in the reporting. Combining them into a claim that an autonomous AI system independently decided to steal funds would go beyond the account.

The interview does not identify the model, list its permissions or provide a transcript of the activity inside the tools. It also does not publish the signing-service configuration. Readers cannot infer from the label “AI” whether a particular customer wallet application or trading API uses the affected components.

For someone using a coding assistant on a computer that also holds wallet access, the incident suggests a practical separation to examine: what software is being installed, and what authority that computer can reach. This is a reader check drawn from the reported entry path. It does not establish that the same software or permissions are present on a customer's machine.

Do not install a purported Binance repair tool sent in a direct message. The reported attack involved convincing people to run software during a seemingly legitimate task. A compensation-themed message asking a customer to install software or transfer assets is not an instruction established by the reports cited here. Open the exchange through your existing app or saved address to check an actual account notice.

What Binance says it has rebuilt

As of the Tuesday interview, Teng said Binance had rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with affected engineers, and expanded security scans across employee devices. Those are the remediation steps he described to CNBC.

He also said an independent expert would review the work. That commitment should be read as a review being commissioned. CNBC's report does not present the completed independent opinion, identify a final audit conclusion or establish that every recommended change has been tested by that reviewer.

The proposed review gives customers a concrete next document to look for: its scope, the systems examined and any findings about the path to wallet authorization. A statement that systems were rebuilt answers a different question from an assessment of why the original controls allowed access. Both can be relevant without treating one as proof of the other.

Replenishment and transfer availability require different checks

Teng told CNBC that Binance had replenished 98% of the affected $6.34 billion in assets and was still purchasing the more illiquid remainder. PANews dates the reported 98% figure to October 31. The reports do not establish the precise moment that percentage was first reached. Neither statement supplies an asset-by-asset availability list for the time a customer reads this article.

Replenishment describes what Binance says it has replaced. A withdrawal request additionally concerns the particular asset and network selected in the account. CNBC says certain withdrawals were temporarily restricted. Do not treat the 98% aggregate as evidence that your selected network is open or that a pending request has completed.

For an existing transfer, use the records you already have:

1. Open the pending request and compare its asset, selected network, amount and request identifier with your saved sending record. Preserve the status displayed for that request before considering another submission.
2. If an on-chain transaction identifier appears, compare the destination and amount against your original receiving instructions. Keep an account request identifier separate from the transaction identifier shown for a broadcast transfer.

If a field is absent, note which field is missing rather than assigning it a value from a recovery headline. A replacement request creates another record to investigate. The June and September interview details do not establish that the original request failed, completed or needs to be repeated. These are checks on your own transfer, with its own asset and network.

For derivatives positions, inspect the orders and collateral shown in your own account separately from withdrawal history. Our funding-rates board and liquidations board are market tools; this article does not use them to claim a measured price response to the interview or to infer the security of a wallet.

Questions the new account still leaves open

The reports opened for this article do not publish a complete forensic timeline between June and October 29. They do not show the exact permissions held by the affected AI tools, the full configuration of the signing service, or a completed independent review. Those are specific gaps in the current reconstruction.

Quick FAQ

Did Binance respond to the June compromise?

According to the preliminary report described by CNBC, it detected suspicious activity, replaced the device and rotated credentials. The same account says the employee's role and colleagues were already exposed.

Did the attack involve only one engineer?

Teng described a June installation involving one engineer and September interviews involving another. He rejected a single-laptop explanation in the interview.

Has the independent review finished?

The CNBC interview describes Binance getting an independent expert to review its work. It does not supply a completed report or a final finding.

Does 98% replenishment mean my withdrawal is ready?

That percentage concerns affected assets Binance says it replaced. Check the status of your exact asset, network and withdrawal request in the account.