In September 2026, a software engineer working for Binance, the world’s largest cryptocurrency exchange, received an invitation to interview for a new job. The opportunity appeared legitimate. There was a recruitment platform, an initial video interview with someone claiming to be a human resources representative and a subsequent conversation with an individual posing as the chief executive of a prospective employer.
Then came the technical assessment.
The engineer was asked to download a coding assignment onto a work computer. Hidden inside the repository was malicious software that would eventually give attackers access to Binance’s internal systems and help them reach the infrastructure responsible for authorising cryptocurrency transactions.
What appeared to be an ordinary recruitment exercise was part of a carefully coordinated cyber operation.
On 29 October 2026, attackers exploited that access to compromise Binance’s internal wallet-signing infrastructure and move approximately $6.34 billion in digital assets across multiple blockchain networks. The Federal Bureau of Investigation (FBI) attributed the theft to North Korea’s TraderTraitor cyber group.
In its initial findings published on 3 November, Binance described a multi-stage campaign involving malicious software downloads, social engineering, compromised employee devices and the exploitation of an internal artificial intelligence tool.
The incident is significant not simply because of the amount stolen, but because of how the attackers reached the systems controlling billions of dollars. They did not begin by directly attacking Binance’s transaction infrastructure. They spent months targeting the people and technology surrounding it.
The operation began months before the theft
The first known compromise dates back to June 2026, when an engineer working in Binance’s Wallet DevOps team attempted to install a popular AI coding assistant.
The engineer downloaded what appeared to be a legitimate Homebrew installation package. However, the package had been tampered with and contained malicious components.
Binance detected an anomaly, replaced the affected computer and rotated the associated credentials. However, the attackers had already gathered information about the engineer’s role and colleagues working on the exchange’s wallet infrastructure.
The initial security response therefore did not necessarily end the threat. It appears to have disrupted the first intrusion while leaving attackers with intelligence that helped them plan their next move.
By September, they had identified another engineer to target.
The fake interview that opened the door
The attackers approached the second Binance employee through a legitimate job-hunting platform, posing as representatives of a fictitious company.
The recruitment process was designed to build credibility. The first interview took place through a video call with someone claiming to represent the company’s human resources department. To establish trust, the interviewer shared a social media account containing personal photographs and videos.
A second interview followed through a popular social messaging application. This time, the individual claimed to be the fictitious company’s chief executive.
The process eventually progressed to a technical assessment. The engineer was instructed to download a coding assignment containing a software repository onto their Binance work computer.
The repository was malicious.
According to Binance, the malware used sophisticated obfuscation and evasion techniques. It replaced a legitimate component of the Python development environment tool, pyenv, with a malicious version, allowing attackers to execute unauthorised commands and establish communication with an external server under their control.
Binance’s endpoint security tools did not detect the malware at the time.
The attackers had not simply tricked an employee into revealing a password. They had persuaded an engineer to introduce malicious code directly into a corporate working environment through what appeared to be a legitimate professional opportunity.
How the attackers exploited Binance’s internal AI tool
By 20 October, the attackers had moved beyond the initially compromised computer.
They used the access obtained through the fake recruitment exercise, together with an internal AI productivity tool, to reach other systems within Binance’s corporate environment.
Their targets included two additional engineers working on wallet infrastructure. Through the compromised environment, the attackers obtained access to credentials and a container deployment token associated with the company’s internal cloud infrastructure.
Such permissions allow authorised users to introduce and manage software applications within corporate systems. In the wrong hands, they can provide a route into infrastructure that ordinary employees cannot directly access.
The involvement of the internal AI tool adds another dimension to the incident. According to Binance’s findings, the tool became part of the pathway through which attackers moved across employee systems.
This raises an important cybersecurity challenge for businesses adopting AI productivity tools: internal AI systems must be treated as part of the corporate security environment, with appropriate access restrictions, monitoring and safeguards.
The October 29 attack: Reaching the wallet-signing infrastructure
The operation reached its execution stage on 29 October.
Between approximately 17:15 and 19:56 UTC, attackers accessed the computer of a third engineer, used compromised credentials and deployed a malicious container within Binance’s infrastructure.
They then gained unauthorised access to an internal transaction-signing service.
This was the critical breakthrough.
Cryptocurrency exchanges use wallet infrastructure to manage and authorise transactions. By compromising the internal signing service, the attackers could initiate transfers outside Binance’s normal withdrawal process.
They also exploited Ethereum’s EIP-7702 authorisation mechanism, which allows an externally owned account to delegate certain execution permissions to a smart contract without revealing its private key.
The attackers used this mechanism to grant an attacker-controlled smart contract execution rights over affected Binance hot wallets. This meant they did not need to steal the underlying private keys to exercise unauthorised control over transactions.
The incident exposed a distinction in cryptocurrency security: protecting private keys is not enough if attackers can compromise the systems authorised to initiate transactions.
Four hours that exposed billions in digital assets
The unauthorised transfers began on the evening of 29 October and continued until shortly before midnight.
Between approximately 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address.
Other assets followed, including approximately 970,500 Solana (SOL) and 44.2 million Optimism (OP). The attackers subsequently moved approximately 18,270 Bitcoin (BTC), alongside other digital assets across multiple blockchain networks.
The final unauthorised Ethereum transfer, involving 2,961.9 ETH, was confirmed at 23:56 UTC.
Binance suspended withdrawals and coordinated with blockchain intelligence firms and token issuers to identify and freeze affected assets.
However, disabling ordinary withdrawals was not enough. The malicious EIP-7702 authorisations had already been established on-chain and needed to be revoked separately.
Binance’s multi-party computation (MPC) wallet architecture added another technical challenge because there was no single master key that could simply be switched off. The company had to develop and execute a specialised revocation procedure to remove the unauthorised delegation.
At approximately 00:10 UTC on 30 October, Binance terminated the malicious authorisations.
By then, billions of dollars in digital assets had already been moved.
North Korea blamed as Binance moves to recover the funds
On 31 October, the FBI attributed the theft to North Korea’s TraderTraitor cyber operation, which is associated with the country’s wider state-linked cyber activities.
The attribution places the Binance incident within a broader pattern of cryptocurrency thefts linked to North Korean cyber operations.
Binance said its security team had detected and prevented 57 suspected North Korea-linked cyber threats during 2026. These included fraudulent recruitment exercises, malicious developer tools, compromised software packages and other social-engineering techniques.
The exchange reported on 3 November that approximately $2.85 billion of the affected assets had been frozen or intercepted through cooperation with blockchain partners, security firms and token issuers, including Tether and Circle.
Binance also said it had set aside sufficient company funds to cover the full financial impact. By 31 October, approximately 98 per cent of the affected token assets had been replenished, with the company purchasing the remaining, less liquid assets.
Its response included rebuilding affected wallet systems and the internal AI tool, replacing compromised devices, revoking credentials and deployment tokens, strengthening security controls and enhancing AI-powered behavioural anomaly detection.
The company also announced plans to commission an independent cybersecurity review.
The bigger lesson: The next cyberattack may begin in human resources
The Binance incident raises questions that extend well beyond cryptocurrency exchanges.
For years, corporate cybersecurity has concentrated on protecting networks, encrypting sensitive information, securing passwords and strengthening authentication systems. Those controls remain essential, but this attack demonstrates that the route into a company’s most sensitive infrastructure may begin somewhere entirely different.
In this case, it began with a job interview.
Recruitment platforms, technical assessments, developer tools and internal productivity applications are increasingly connected to corporate working environments. Each creates opportunities for attackers to exploit the trust employees place in seemingly legitimate professional processes.
For businesses adopting artificial intelligence, the implications are particularly important. An internal AI assistant may appear to be a productivity tool, but if it has access to sensitive systems, it can also become part of an organisation’s attack surface.
The incident also challenges the assumption that strong cryptographic security alone is sufficient to protect digital assets. Binance’s MPC architecture did not prevent attackers from exploiting the authorisation infrastructure surrounding its wallets.
The broader lesson is that cybersecurity must extend beyond networks and technology to include recruitment processes, employee devices, software supply chains, privileged credentials and internal AI applications.
The $6.34 billion Binance incident began with seemingly ordinary professional interactions. By the time attackers reached the wallet-signing infrastructure, they had spent months building access, gathering intelligence and exploiting trust.
The most expensive part of the attack was not the technology used to steal the money. It was the time spent making the intrusion look like ordinary business.
