My last article covered how the Binance hack happened and how ordinary users can protect themselves. That was written from the first days of reporting. Since then, Binance has published its own detailed report — and it changes the story in an important way. The hack was not a single bad night. It was a six-month campaign. And in the same week, a second major exchange was hit too.

What Binance's own report added

Binance published its initial findings on November 3. The timeline it reconstructs has four stages:

June — a tampered installer. An engineer on the wallet DevOps team went looking for a popular AI coding tool and downloaded a tampered Homebrew installer from a search result. Binance says its security team caught the anomaly, replaced the device, and rotated the related credentials. But by then, the attacker had learned the engineer's role and the identities of colleagues on the wallet infrastructure team. Binance is careful on one point: its report does not establish uninterrupted access from June to October.

September — a fake job interview. A second engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. After a live video screening, he was asked to download a code repository onto a company computer as part of a technical assessment. The code hid malware that swapped a legitimate development component for a poisoned one — replacing a valid pyenv binary of 3,344 bytes with a malicious copy of 3,414 bytes, a 70-byte difference that was enough to run commands and open a channel to an attacker-controlled server.

October 20 — the pivot. Using the compromised computer and an internal Binance AI tool, the attacker gained control of two more engineers' machines. One of them held a container deployment permission token. From there, the attacker could deploy a container and reach wallet signing operations. Binance says the attacker then exploited Ethereum's EIP-7702 feature, which lets an account delegate execution rights to a smart contract without exposing its private key.

October 29 — the theft. About $6.34 billion in Binance's updated figure, the largest crypto theft on record. The FBI has attributed it to TraderTraitor, a North Korean state-backed group it also blames for the $1.5 billion Bybit theft of February 2025. North Korea has denied the attribution.

Two numbers in the report deserve attention. First, Binance says it has frozen or intercepted about $2.85 billion, and that 98% of affected assets have been replenished, with the company absorbing the loss rather than passing it to users. Second, Binance says its security team detected and stopped 57 suspected North Korea-linked threats during 2026. One campaign slipped through. Security, in other words, is a rate, not a state — even a team stopping 57 attacks can miss the 58th.

Binance also says it has rebuilt the affected wallet system and internal AI tool, replaced devices, decommissioned related credentials, and expanded device scanning. Those remediation claims have not yet been independently verified, and Binance says independent firms will review its findings.

The second exchange, the same week

On November 2, Brazil's largest exchange, Mercado Bitcoin, suspended deposits and withdrawals after what it called a security incident in one of its systems. Its app was also reported offline during the incident.

The loss figures differ by source, and that itself is worth noting: the exchange puts the value of assets involved at about $38 million and says customers suffered no losses and no data leaked, and that it will absorb the cost. Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains; other investigator estimates run higher, up to about $49 million. Tether froze more than $4.5 million in USDT linked to the incident. Days later, deposits and withdrawals remained suspended with no restart date announced.

Mercado Bitcoin has not said how attackers got in or which system was breached. The confirmed facts are narrower than the headlines: an incident the exchange contained, a precautionary halt, customer balances the exchange says are recorded and guaranteed, and an investigation still running.

What this changes for small holders

My last article gave six protections. This follow-up adds four lessons that only the second week of reporting makes clear:

1. The attack surface includes your tools, not just your passwords. The Binance campaign began with a developer tool download and a job-assignment repository — not a guessed password or a leaked key. For ordinary users, the equivalent is simple and free: download wallets and software only from official sources, and treat any "test this code" or "install this tool" request from a stranger as hostile, however professional it looks.

2. A halted exchange is a risk even when nothing is stolen. Mercado Bitcoin says its customers lost nothing. But for days, those customers could not deposit or withdraw at all. Theft is one risk; loss of access is another. If everything you own sits on one platform, a precautionary suspension freezes you too. Spread holdings across more than one place, and keep anything meaningful in a wallet you control.

3. "Fully covered" depends on a balance sheet, twice over. Binance could replenish 98% because it is enormous. Mercado Bitcoin says it will absorb its losses because it can. Both statements were true this time. Neither is a property of exchanges in general. When you choose where to keep crypto, the question is not only "has it been hacked" but "could it pay if it were."

4. Stablecoin freezing cuts both ways, again. In the Binance case, Tether and Circle froze about $1.8 billion of stolen stablecoins. In the Mercado case, Tether froze $4.5 million more. Freezing is a backstop when coins are stolen — and a reminder that USDT and USDC exist at their issuers' discretion. That is not a reason to avoid stablecoins. It is a reason not to hold everything in one of them, on one chain, on one platform.

The zero-capital version, again

My Publish0x balance is still tiny, and none of this was aimed at me. But every lesson here costs $0 to apply: official sources only, more than one platform, your own wallet for anything you would hate to lose, and no single stablecoin as your only store of value. The Binance report is a reminder that the most expensive security failures start months before anyone notices — with a download, an interview, a tool that looked legitimate. The habits that stop those are free, and they work best when you build them before you need them.