On October 29, 2026, Binance fell victim to a sophisticated cyber attack orchestrated by North Korean hackers, resulting in the theft of approximately $6.34 billion in cryptocurrency. The exchange reported that a combination of deceptive recruitment strategies and the exploitation of an internal artificial intelligence tool enabled the attackers to penetrate its wallet infrastructure, as detailed in their incident report released on November 3.
The breach initiated in June when a wallet DevOps engineer inadvertently downloaded a compromised Homebrew installation while searching for an AI coding tool. Although Binance promptly detected this activity and replaced the device, the attackers managed to glean critical information about the engineer’s role within the company, setting the stage for further exploitation. In September, a second engineer, referred to as Engineer B, was lured into a fake job interview through a job-hunting platform, where he was ultimately persuaded to download a malicious coding assignment onto his work laptop.
This assignment included malware that replaced a legitimate file with a malicious version, granting the attackers remote access to Engineer B’s device. On October 20, this access was further broadened as the compromised system was used alongside an internal AI tool to infiltrate the machines of two additional engineers, including one who possessed a critical container deployment token. The specifics of how the AI tool facilitated this access remain undisclosed.
The breach escalated on October 29, when attackers accessed Engineer C’s computer, leveraging credentials stolen from Engineer A to execute a malicious script that triggered the unauthorized transfer of vast sums of cryptocurrency from Binance’s hot wallets. Within the span of a few minutes, substantial amounts of XRP, SOL, OP, and BTC were siphoned away. Notably, the attackers exploited Ethereum’s EIP-7702 account-authorization mechanism, allowing them to delegate execution rights without exposing sensitive private keys. This strategic choice complicated Binance’s efforts to suspend withdrawals and revoke on-chain authorizations immediately, as their multi-party computation wallet system did not consolidate a singular private key.
Despite the challenges presented by the incident, Binance reported that approximately $2.85 billion had been frozen or intercepted, although this figure remains subject to further reconciliation. The exchange mentioned that by October 31, 98% of the affected token assets had been replaced, although this does not equate to the recovery of stolen funds. Binance asserted it has since rebuilt affected systems, replaced compromised devices, and instituted stricter access controls, with an independent cybersecurity firm currently examining the findings.
These developments follow a previous incident in February 2025, when cyber criminals believed to be linked to North Korea reportedly stole $1.5 billion from Bybit. This trend highlights the ongoing threat posed by state-sponsored cyber attackers, particularly those associated with North Korea’s Lazarus Group.
Gina Cardelli, Director of Platform and Threat Intelligence at Fortra, expressed concern regarding security measures surrounding employee devices used in recruitment scenarios, highlighting how the initial compromise provided a foothold for external threats. Such breaches serve as a critical reminder for organizations to bolster their cybersecurity defenses, particularly around employee practices and external engagements.
In terms of the MITRE ATT&CK framework, the attack utilizes several tactics and techniques. Initial access was achieved through social engineering and spear-phishing, while persistence was maintained through the malware installed on compromised devices. Additionally, privilege escalation occurred as attackers gained unauthorized access to sensitive systems. The complexity of such an attack underscores the need for robust cybersecurity strategies to mitigate risks associated with insider threats and advanced persistent threats.