CZ calls for a crypto security alliance as Binance's report traces the $6.34 billion hack to fake job interviews

What the preliminary report says happened

PANews published its summary of the report at 22:36 SGT on 3 November. According to that summary, the attackers:

• approached employees through fake job interviews;
• got tampered Homebrew installation packages onto their machines;
• used internal AI tools to move step by step across several employees' devices;
• reached the internal wallet-signing service;
• then used Ethereum's EIP-7702 authorization mechanism to move XRP, SOL, BTC, ETH and other assets out of hot wallets.

(PANews, Binance preliminary report summary)

Odaily's newsflash on the same report gives the headline numbers: about $6.34 billion in digital assets involved, more than 100% of the affected value already set aside for compensation as of 3 November, 98% of affected tokens replenished, and about $2.85 billion frozen or blocked, a figure Odaily says still needs reconciliation and moves with market prices. (Odaily newsflash on the preliminary report)

PANews dates the 98% replenishment figure to 31 October, while Odaily places it as of 3 November. The summaries therefore do not establish exactly when that percentage was reached.

The PANews summary adds that Binance has rebuilt the affected systems and will hire an independent third party to review the incident. We did not open the full report itself. The method details above are as summarized by PANews from Reuters and the report, and we have not found a second outlet confirming each step.

On 30 October we reported that analysts were treating EIP-7702 delegation as a hypothesis for how the funds moved (our EIP-7702 research note). The report summary now puts that mechanism at the last step, after the signing service had already been reached. It does not say every chain used the same route.

What CZ said in the interview

CZ no longer runs Binance. In the interview with host Jacquelyn Melinek, he said he learned of the attack near midnight in the UAE, from the team and from X at almost the same time, and that his role afterwards was mainly communicating with users. ChainCatcher published a full Chinese transcript at 21:00 SGT. (ChainCatcher transcript)

His main points, as reported by PANews and the transcript:

On the scale of the problem, CZ argued that tokenized stocks, RWAs and stablecoins tied to short-term government debt now link crypto to the wider financial system, so a hack of this size is a matter extending beyond corporate security but one of national security. He also said he would not predict prices.

Withdrawals: what Binance has reopened

Binance's Recovery Update #6, posted at 10:40 SGT on 3 November, says withdrawals for a second group of assets would reopen from 12:00 SGT (04:00 UTC) that day. The notice says listed assets will return at different times, and each network-asset pair is restored after security checks. Deposits remain open, according to the notice. (Binance Recovery Update #6)

The list covers BSC, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base. A few examples from it:

Binance says users may see delays during the rollout and should retry later if a withdrawal fails. The notice repeats that Binance will bear the financial impact of the theft and that losses will not be passed on to users.

Money has started coming back

Binance said on X that that by 03:00 UTC (11:00 SGT) on 3 November hourly deposits exceeded withdrawals, according to Cointelegraph. Two DefiLlama readings taken at different times put the 24-hour net figure at:

(PANews flows item)

(Cointelegraph on net inflows)

These are different reported snapshots of a rolling 24-hour window; they do not establish a like-for-like change between fixed periods. PANews also cites DefiLlama for Binance's total tracked assets of about $127.7 billion.

CZ's own explanation for the return was that several hardware wallets had security incidents recently, so some users who withdrew compared the options and deposited again. That is his reading, not something the flow data shows.

What to do if you hold funds on Binance

1. Check your asset on the withdrawal page before you plan a transfer. The notice says to confirm availability for the selected asset and network or on Binance's network status page. A coin can be open on BSC and still closed on Ethereum.
2. Expect phased access. If a withdrawal fails, Binance's own advice is to retry later. Keep the failed request details so you can distinguish it from a later successful submission.
3. Ignore anything that says "compensation". Binance says it bears the loss. Do not treat an unsolicited compensation message as an instruction to transfer money; a related example appears in our report on the GRAM vault scam.
4. If you move coins to self-custody, back up the seed phrase first. CZ made this point himself: many self-custody losses come from lost or damaged seed phrases, not hacks.
5. Watch your positions, not just your balance. For a separate check on derivatives positions, our liquidations board and funding rates board provide reader tools for reviewing those markets; they are not evidence of the cause of this breach.

What the alliance would and would not change

A security alliance as CZ described it would do three things: share incident lessons, run cross-audits, and coordinate fast freezes. The reported frozen funds show why coordination matters to this proposal. Odaily's report puts frozen or blocked assets in this case at about $2.85 billion, which is the part of the loss that faster coordination targets.

The report summary describes a sequence beginning with employee devices and reaching wallet authorization. Our reading is that a useful review must examine both stages: how malicious software reached an employee, and why that access could reach signing infrastructure. The summaries do not establish which control would have stopped the complete sequence.

What we could not confirm

• The full preliminary report text; we relied on the PANews and Odaily summaries.
• The source of CZ's "6% to 10%" figure for funds that went to other exchanges.
• Whether the alliance has members, a name or a start date. CZ said its form is undecided.

Quick answers

How did hackers get into Binance?

According to PANews's summary of Binance's preliminary report, through fake job interviews, tampered Homebrew installation packages and internal AI tools that let attackers reach several employees' devices and then the internal wallet-signing service.

How much was taken in the Binance hack?

The preliminary report puts the assets involved at about $6.34 billion, with about $2.85 billion frozen or blocked and 98% of affected tokens replenished, per Odaily.

Can I withdraw from Binance now?

Partly. A second phase of withdrawals began at 12:00 SGT on 3 November, rolling out by asset and network. Deposits stayed open throughout.

What is the security alliance CZ proposed?

An industry group to share best practices, cross-audit each other and coordinate fast freezing of stolen funds. CZ said it has been discussed but its form is not set.

Tokenized-stock reader hub