Binance Breach Report and Tether's Bitcoin Remark Put Disclosure in Focus

By Coinvote

Published November 4, 2026 - 07:21 UTC | 5 mins read

Binance's postmortem traces a $6.3 billion theft to fake recruiters and a compromised AI tool, while Tether's CEO says the company holds about 150,000 bitcoin, roughly 50,000 more than its reserve report implies. Both disclosures raise questions about transparency at core crypto intermediaries.

Binance blames a months-long campaign for the $6.3 billion theft

Binance published a postmortem on Tuesday that describes the Oct. 29 theft as the end of a long infiltration, not a single failure. According to Cointelegraph, the exchange says attackers used compromised employee computers and stolen credentials to reach its wallet infrastructure. The Block summarized the same report as citing a bogus interview for a job and an in-house AI system.

Co-CEO Richard Teng put it plainly on X: "This wasn't one mistake or one breach — it was a months-long campaign." Cointelegraph calls the incident the largest cryptocurrency hack in history. The exchange says it will absorb the losses instead of passing them to customers.

How the intrusion unfolded, according to Binance

Cointelegraph's account of the report gives a clear timeline. Each stage used access won in the previous one, which is why the later steps could bypass the exchange's normal controls.

June: an engineer installed a tampered software package during the setup of an AI coding assistant. Binance detected the malware and replaced the device, but the attackers had already learned about the wallet team.
September: attackers posing as recruiters got another engineer to open a harmful file presented as a coding task. The malware evaded the exchange's security protections.
Oct. 20: the attackers used that computer and an internal AI tool to reach two more engineers' systems and obtain deployment credentials.
Oct. 29: they installed malicious software in the wallet infrastructure and reached the internal wallet-signing service, which authorizes transactions.

Why withdrawal freezes did not stop the outflow

Binance told readers that the attackers also used Ethereum's EIP-7702 mechanism. It lets a wallet delegate transaction permissions to smart contracts. According to the exchange, this allowed unauthorized transfers to continue even after withdrawals were suspended. Its multiparty computation wallet system, which splits control over signing, made revoking those permissions harder.

The exchange reports that $2.85 billion has been frozen or intercepted, and that by Oct. 31 it had restored 98% of the token assets that were affected. The FBI has attributed the attack to North Korean hackers. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied involvement on Tuesday and called the attribution politically motivated. Co-founder Yi He said Binance had detected and prevented 57 suspected North Korea-linked threats in 2026, including fraudulent job interviews and malicious software packages.

Tether's CEO cites a bigger bitcoin stack than its attestation shows

On the same day, Tether CEO Paolo Ardoino told the Plan ₿ Forum in Lugano that the company holds "give or take 150,000 bitcoin," worth about $11.5 billion. Decrypt and Bitcoin Magazine both noted that Tether's third-quarter reserve report implies a smaller position. That report lists $8.37 billion of bitcoin at $83,621 per coin, or about 100,060 BTC.

The difference is roughly 50,000 coins, which Decrypt values at close to $3.8 billion. Ardoino did not say where the extra bitcoin is held or when it was bought. Both outlets stress that the remark does not point to a new purchase of that size. Tether has long said that investments funded from its profits are kept apart from the reserves that back USDT.

Bitcoin Magazine adds detail the other outlet lacks. According to Bitcoin Magazine, the attestation came out on Oct. 30 with a BDO sign-off and implies about 1,130 more coins than the approximately 98,930 recorded at the close of the second quarter. Price movement, rather than buying, drove most of the $2.57 billion increase in the bitcoin line over the quarter. It also says the stated holdings would rank Tether behind Strategy's 848,517 BTC among corporate holders.

Where the outlets agree and where they differ

Decrypt and Bitcoin Magazine agree on the core numbers: the 150,000 claim, the 100,060 implied figure and a reserve surplus of $7.95 billion against $4.11 billion in June. They differ on emphasis. Decrypt frames the gap as a transparency problem. Bitcoin Magazine offers a possible explanation, that holdings of Tether Investments sit outside the attested reserves, while noting that Ardoino did not confirm which entity holds them.

The outlets also diverge on the audit. Decrypt says Tether began its first full audit with KPMG this year. Bitcoin Magazine says that audit was completed in August. Readers should treat the status as unsettled until Tether or KPMG clarifies. On the Binance side, Cointelegraph supplies the full chain of events, while The Block's summary supports only the fake interview and the internal AI tool.

Why both disclosures matter to holders and project teams

Both stories are about what a large intermediary can prove to outsiders. Binance has given a detailed account of how attackers moved from one engineer's device to the signing service. Tether has given a headline number that its audited filings do not yet support. For anyone holding assets on an exchange or in USDT, those are different risks, but each turns on how much detail a firm will publish.

Bitcoin Magazine points out that Tether's reserves lean on bitcoin at $8.37 billion and gold at about $19.1 billion, which together exceed the $7.95 billion surplus several times over. A sharp fall in either asset would eat into that cushion. Bitcoin was near $77,600 on Tuesday, per Bitcoin Magazine, and CoinGecko data shows it at $77,984, down 9.1% over 30 days and well below its $126,080 peak from October 2025.

Project teams that rely on exchange infrastructure can draw a practical point from the Binance report. The entry points were recruitment contact, a coding test and AI tooling used by staff. Teams tracking new Ethereum projects on Coinvote's new Ethereum listings page can check whether those projects describe their own signing and key-management setup.

What to watch next

Several questions remain open. Neither outlet reports whether Tether will publish a breakdown of coins held outside the reserve, and Bitcoin Magazine says the company has not said so. It is also unclear whether positions such as Twenty One Capital or mining ventures sit inside the 150,000 figure.

For Binance, the open items are the final recovery total beyond the $2.85 billion frozen or intercepted, and whether further detail emerges on the EIP-7702 delegations. The competing statements from the FBI and North Korea also leave attribution contested in public.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,984	+1.9%	-3.6%	$1.57 trillion
Ethereum (ETH)	$2,297	+2.2%	-2.3%	$280.55 billion

CoinGecko data as of 2026-11-04 (UTC); DeFi TVL from DefiLlama: Ethereum $44.11 billion.

On Coinvote

New Ethereum Tokens Listed Today: 2,934 projects tracked, 5 new listings in 7 days, 47 community votes today.
Best Ethereum Meme Coins Today: 260 projects tracked, 2 new listings in 7 days, 16 community votes today.

FAQ

How did hackers get into Binance's wallet systems?

According to Binance's postmortem as reported by Cointelegraph, attackers began in June with a tampered package tied to an AI coding tool. They then used a fake recruiter's coding assignment in September and stolen deployment credentials to reach the wallet-signing service on Oct. 29.

How much bitcoin does Tether hold?

CEO Paolo Ardoino said Tether holds about 150,000 bitcoin, worth roughly $11.5 billion. Its third-quarter reserve report implies about 100,060 BTC, so around 50,000 coins are not shown in the attestation.

Why does the Tether figure not match its reserve report?

Ardoino did not explain the gap. Bitcoin Magazine notes that Tether keeps investments made from profits separate from the reserves backing USDT, so coins held that way would not appear in the attestation.