Binance’s US$6.34bn theft ran from a fake job test through an internal AI tool

01Four steps from June to 29 October, in Binance's words

Binance calls it “a sophisticated, multi-stage campaign” and “not a single isolated breach or a simple phishing incident.”¹ In June, “Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine.” Homebrew is the common package manager developers use to install tools on a Mac. Binance’s security team “detected the anomaly, replaced the device, and rotated all related credentials”, but by then “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.”¹

In September a second engineer, B, was “contacted through a legitimate job-hunting platform by an individual posing as a Project Director”. A purported HR representative ran a live video interview, and someone “claiming to be the CEO of a fictitious company” followed. B was told to download an “assignment” containing a malicious code repository onto his work computer; the code “executed during the setup process”, replacing a legitimate development tool component with a malicious one that ran commands and talked to an attacker’s server. “The 0-day malware was not detected by the endpoint security protection tools at the time,” and the attacker removed traces of it.¹

On 20 October the two threads met. “The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C.” On A’s computer (his first had been replaced in June) the attacker “soon discovered” a “container deployment permission token”. On 29 October, “between 17:15 and 19:56”, the attacker logged onto C’s computer, used A’s credentials, deployed a container and “triggered a malicious script to launch the attack.” From there it had “unauthorized access to an internal wallet signing service”, and between 20:05 and 20:09 UTC (01:35 to 01:39 on 30 October in India) five hot wallets sent 233.46 million XRP to an attacker’s address. Binance also lists about 970,500 SOL, 44.2 million OP and 18,270 BTC sent to attacker addresses.¹

02Every link was a path the company trusted

No step in Binance’s account needed a stolen private key. Each uses something an engineer is meant to use: a search engine to find a tool, a job platform, a take-home coding test, a colleague-facing internal tool, a token that deploys containers, and a signing service that signs what the deployment asks it to. The last step used Ethereum’s EIP-7702, which, in Binance’s words, “allows an account to delegate certain execution rights to a smart contract without exposing the private key.” Through the signing service, the attacker gave “an attacker-controlled smart contract partial execution rights over a Binance hot wallet.”¹ That is why Binance could say on 30 October that it had found no evidence of a private key leak:² no key had to leave. And because the hot wallet used MPC, where no single party holds a whole key, “there was no single private key that could be used to immediately revoke” the authorisations; Binance built “a specialized procedure”, and at 00:10 UTC sent an authorisation from its Binance14 hot wallet to the zero address, clearing the delegation.¹

Binance has seen this pattern before. Its report says it detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using “fraudulent job interviews, malicious software disguised as popular developer tools”, compromised software packages and browser extensions, and fake video-conferencing apps.¹ The September lure matches what a joint advisory of 18 September from Japan’s National Police Agency, the FBI, Australia’s ASD and two German agencies describes for the group it calls WaterPlum, better known as “Contagious Interview”: actors who “require job seekers participate in technical online virtual interviews or complete technical coding assignments”, and who have infected “at least 30,000 devices in more than 100 countries”.¹⁰ Binance itself has not tied its compromise to a named campaign.⁷ The June lure has a public twin too: on 1 May the SANS Internet Storm Center documented search ads leading to a fake Homebrew page that installed the MacSync stealer.¹³ Binance does not say whether its June installer came the same way.

03US$6.34bn impacted, 45% frozen, 98% refilled by Binance

“Approximately USD 6.34 billion in digital assets were impacted by the incident,” Binance says, and “approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.” Separately, “as of 31 October 2026, 98% of the impacted token assets have been replenished”, verifiable on its Proof of Reserves page: Binance refilled its wallets from its own funds, which is not the same as getting the stolen assets back.¹ Our Note of 30 October reported that Tether and Circle froze about US$1.8bn of stolen stablecoins within the first hour, by TRM Labs’ reconstruction; Binance put the frozen total at about US$3bn that day.³² Its 3 November figure, after reconciliation began, is US$2.85bn.

Binance does not make its own attribution: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible.”¹ The FBI’s alert of 31 October, with the Secret Service and IRS Criminal Investigation, names TraderTraitor, lists 628 addresses (608 Ethereum, 19 Bitcoin, one Solana) and says the actors are converting the assets “primarily into Ethereum (ETH)”, as SecurityWeek reported it.⁴¹⁶ North Korea’s Kim Yo Jong called the accusation “absurd” in a statement on 2 November, The Record reported. Binance’s co-chief executive, Richard Teng, called it a “months-long campaign”.⁵ Elliptic counted about US$3.18bn still in theft-linked addresses on 3 November, SecurityWeek reported.⁶

04Six published controls, one for each link

None of the controls that break this chain is new. The FBI warned the crypto industry in September 2024 that North Korean actors use “offers of new employment”, and listed “requests to conduct a ‘pre-employment test’ or debugging exercise” as a warning sign.⁸ CISA, the FBI and the US Treasury described TraderTraitor in April 2022 as sending messages that “mimic a recruitment effort” to people “often working in system administration or software development/IT operations (DevOps)”: the roles of engineers A and C.⁹ Set against Binance’s four stages, six published controls each cut at least one link.

Binance’s own list of what it has done runs along the same lines: it “rebuilt the affected wallet system in a new environment”, “rebuilt the affected internal AI tool and access controls”, replaced devices, “decommissioned credentials and tokens related to affected engineers”, scanned all employee devices, strengthened “wallet-service risk controls” and AI-based behavioural anomaly detection. Next it has promised an independent third-party review, more spending on “AI-enabled detection, endpoint protection, developer-environment security”, and a security research fund with AI companies, of undisclosed size.¹