On October 29, 2026, attackers drained roughly $6.34 billion in digital assets from Binance in about 20 minutes, the largest cryptocurrency theft on record and more than four times the $1.5 billion Bybit hack of 2025. The FBI attributed the attack to TraderTraitor, a North Korean group also tracked as Lazarus Group, Jade Sleet, and APT38.

Binance's own incident report, published on November 3, shows that the attackers reached the exchange's wallet signing infrastructure through a recruiter message, a coding assignment, and an internal AI tool. Below is how the attack worked, and what it means for any organization that holds high-value systems behind trusted internal access.

How the attack unfolded

Binance describes a multi-stage campaign that chained social engineering, custom malware, a compromised internal AI tool, endpoint access, and an on-chain authorization trick. The timeline below is based on the company's incident report and early reporting, and details may change as the investigation continues.

June 2026: An engineer on Binance's Wallet DevOps team downloaded a tampered Homebrew installation while searching online for a popular AI coding tool. Binance detected the suspicious activity, replaced the device, and rotated the associated credentials, but information about the engineer's role and colleagues had already been exposed.

September 2026: A second software engineer, whose public profile referenced his experience at Binance, was contacted through a legitimate job-hunting platform by someone posing as a Project Director at a fictitious company. The first interview was a live video call with a fake HR representative, who shared a social media account full of personal photos and videos to build trust. The second took place on a popular chat app with someone claiming to be the company's CEO, and near the end the engineer was asked to download a technical “assignment” onto his work computer.

The malware: The repository contained malicious code that ran during setup. On macOS it replaced a legitimate development tool component (the pyenv executable in the Homebrew directory) with a malicious version that executed commands from an attacker-controlled server. Binance says the custom malware used obfuscation, was not detected by its endpoint security tools at the time, and was followed by steps to remove traces of the compromise.

October 20, 2026: The attacker used the compromised computer and an internal AI tool to take control of two more employees: the Wallet DevOps engineer targeted in June and a wallet software engineer. On the DevOps engineer's machine, the attacker found a token with container deployment permissions.

October 29, 2026: Using the stolen credentials, the attacker deployed a container and ran a malicious script that gave access to Binance's wallet signing service. Transfers began around 4:05 p.m. ET on the XRP Ledger and 4:20 p.m. ET on Ethereum and Bitcoin, spanning ten blockchains. Five hot wallets sent 233.46 million XRP to an attacker-controlled address, and other transfers included about 970,500 SOL, 44.2 million OP, and 18,270 BTC.

The final stage is what made the theft so hard to reverse. The attackers abused Ethereum's EIP-7702 mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Because those authorizations already existed on-chain, suspending withdrawals did not stop the transfers, and because Binance uses multi-party computation there was no single private key to invalidate them. The company had to develop a specific revocation procedure. The last unauthorized transfer, 2,961.9 ETH, was finalized at 23:56 UTC, and Binance cleared the malicious authorization at 00:10 UTC on October 30.

Why Binance was a target

Cryptocurrency exchanges hold digital assets on behalf of their users, which concentrates an enormous amount of value in a small number of systems. They face many of the same threats as banks and other financial institutions, yet the industry is young and has not been subject to the decades of operational risk and security regulation that traditional finance has. That mix of concentrated value and still-immature controls is what makes exchanges such a prize.

North Korea has also turned crypto theft into a revenue strategy. Binance said its security team had detected and prevented 57 suspected North Korea-linked incidents during 2026 alone, including fake job interviews, malicious developer tools, compromised software packages and browser extensions, and fake video conferencing applications. The fake recruiter approach follows the pattern documented in the Contagious Interview and Operation Dream Job campaigns, and a joint advisory published in September by Japan's National Police Agency, the FBI, and partner agencies reported at least 30,000 infected devices across more than 100 countries tied to the Contagious Interview group.

The aftermath

Binance halted trading and suspended withdrawals after the theft, then announced the following day that it would absorb the losses and that user funds were safe. Tether and Circle froze part of the stolen stablecoins within the first hours, and as of November 3 Binance reported that about $2.85 billion of the stolen assets had been frozen or intercepted. The company said 98% of the impacted token assets had been replenished as of October 31 using its own reserves, and customer withdrawals resumed on November 1. Binance has since rebuilt the affected wallet environment and internal AI tool, replaced compromised devices, revoked the stolen credentials and tokens, and brought in independent security firms to review its findings.

On attribution, the FBI pointed to North Korea in the days after the theft and Binance cited that finding publicly on November 3. North Korea has rejected the allegation. Binance's first statement blamed a single compromised DevOps laptop; its later investigation found several more points of entry.

What stops this kind of chain

No single control would have stopped this attack, and Binance's report does not point to a flaw in an AI model or a cryptographic primitive. Each step used legitimate access held by a compromised person or tool: a developer's laptop, an internal AI application with reach into other employees' environments, a deployment token on a workstation, and a signing service that accepted instructions from that path. The controls that interrupt a chain like this are the ones that limit what a trusted identity can do after it is compromised.

• Segregation of duties so that no single user can initiate and also finalize a transfer.
• Short-lived, tightly scoped deployment credentials that never sit on developer workstations.
• Limits on the size and rate of transfers, with alerting on large movements and MFA on the use of private keys.
• Internal AI tools that do not inherit broad access to employee systems or sensitive environments.
• Isolated environments for technical assignments and untrusted code, along with endpoint detection and behavior analytics on every employee device.
• Recruitment awareness training, since the entry point in this case was a job offer.

What happens after the first compromise

In this breach, the entry point and the eventual damage were months and several systems apart. A compromised laptop in September became access to a wallet signing service in October, and each control along the way worked as designed for the identity that was using it. If you measure security only by how well the perimeter holds, you will never see this path.

An Internal Network Pentest is built to find that path before an attacker does. Thoropass pentesters start from the position an attacker reaches after an initial compromise, such as a phished employee or an infected workstation, and test what an attacker could actually do from there: harvest credentials and tokens, move laterally, escalate privileges, get around network segmentation, and reach critical systems like the ones that sign transactions. Every finding is validated by a human tester and comes with specific steps to fix it, and 90 days of unlimited retests let you confirm the fixes.

The same approach applies to the first step of the chain. Phishing and red team engagements simulate a motivated external attacker who reaches your people through the same means used against Binance, including fake recruiter outreach and malicious coding assignments delivered to developers. These exercises show whether your employees would run the code, whether your endpoint tools would catch it, and how far the access would go if they did, so you can measure the full path from the first message to the systems that matter most.

If you want to know how far a single compromised device could take an attacker in your environment, reach out to the Thoropass Pentest Team to scope an Internal Network Pentest.

‍