On 29 October 2026, Binance was hit by one of the most sophisticated and financially devastating cyberattacks in the history of digital assets. The FBI attributes the operation to a North Korean hacking group it tracks as “TraderTraitor,” and the scale is staggering: more than $6 billion in cryptocurrency was stolen, with Binance putting the exact impact at roughly $6.34 billion. This was not a simple phishing email or a lucky password theft. It was a multi-stage campaign that combined social engineering, poisoned software, and a hijacked internal AI tool to reach the very heart of Binance’s wallet infrastructure. The attack began months earlier, in June 2026, when a wallet DevOps engineer went looking for an AI coding tool online. The engineer found what looked like a legitimate package, but it had been tampered with, and installing it via Homebrew delivered a hidden backdoor to the company’s network. Binance detected the compromise and did what most security teams would do: replaced the device and rotated credentials. But the damage had already been done. The attacker had learned exactly who worked on wallet infrastructure, and that knowledge would become the foundation for a far more dangerous intrusion later.
The second stage of the attack was a textbook piece of psychological manipulation. In September, another engineer was approached on a job platform by someone pretending to be a “Project Director.” The conversation felt natural, professional, and completely believable. Two interviews followed. The first was with a fake HR person, and the second was with a fake CEO. During the first interview, the fake HR person shared personal social media content, small details that made the entire charade feel authentic and trustworthy. Near the end of the second interview, the engineer was told to download an “assignment” onto his work computer. That request, framed as part of a coding challenge, was the trap. The file was not a coding task. When the engineer ran it during setup, the malicious code executed immediately. It replaced a legitimate pyenv file with a malicious copy, created a new symlink, and started a zsh shell. The malware was a zero-day, meaning no existing security tool had ever seen it before. It slipped past Binance’s endpoint protection, executed its payload, and then wiped its own traces from the system. The engineer had no idea that his computer was now a doorway into one of the most valuable cryptocurrency exchanges in the world.
By 20 October, the attacker had moved deeper into Binance’s internal systems. Using the compromised engineer’s computer and an internal AI tool, the attacker managed to take control of two more engineers’ accounts. One of those engineers held a container deployment token, a powerful credential that allowed access to the systems where Binance’s wallet services ran. For more than a week, the attacker quietly positioned themselves for the final strike. Then, on 29 October, between 17:15 and 19:56 UTC, the attacker logged into the third engineer’s computer. Using the stolen deployment token, they deployed a container and ran a malicious script. This was the moment the attack shifted from espionage to robbery. The script used Binance’s own wallet signing service to move funds outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP out of the exchange. That was only the beginning. Later transfers included roughly 970,500 SOL, 44.2 million OP, and 18,270 BTC. The attacker was not just draining accounts; they were using Binance’s own infrastructure to authorize the theft, making it look like legitimate transactions to anyone watching from the outside.
What made this attack particularly clever was the way the attacker used Ethereum’s EIP-7702 feature. This feature allows an account to hand some execution rights to a smart contract without revealing its private key. The attacker sent 50 signing transactions, carefully matching the wallet’s changing nonce, which is a transaction counter that changes with every action. Most of those attempts failed, but one worked. That single successful transaction changed the wallet’s code so that it pointed directly to the attacker’s smart contract. Stopping withdrawals did not undo the damage, because the delegation lived on-chain, not in Binance’s internal systems. Even worse, Binance’s wallet used Multi-Party Computation, or MPC, which means no single person held the key, but no single person could quickly revoke the attacker’s control either. The team had to build a special procedure from scratch. At 00:10 UTC on 30 October, they cleared the malicious delegation by authorizing the zero address, a technical move that removed the attacker’s code but did not replace the signing key. It was a race against time, and Binance managed to freeze or intercept about $2.85 billion of the stolen funds. Still, billions had already left the exchange, and the company announced that it would absorb the loss itself, saying that 98% of impacted tokens had been replaced by 31 October, with users able to verify the recovery through its Proof of Reserves page.
This attack did not happen in isolation. Security researchers have long warned about North Korean hackers posing as recruiters, and this campaign fits a disturbing pattern. Earlier reports on a group called WaterPlum described fake recruiters infecting more than 30,000 devices around the world. Another report on TraderTraitor’s use of Terraform showed the same group deploying fake DevOps coding tests to compromise developers. The Binance attack was simply the most audacious version of that strategy yet. The stolen funds are already being laundered. According to reports, the FBI says the actors are converting the stolen assets mainly into Ethereum, and expects further laundering through decentralized finance platforms and swap services. Binance, meanwhile, has gone into full recovery mode. The company rebuilt its wallet system and its internal AI tool, replaced affected devices, and removed the compromised engineers’ credentials. It also scanned every employee device, added AI-based anomaly detection, and launched an independent review of the incident. The funds used to cover the losses reportedly came from the SAFU reserve, an insurance fund, and company money. But the deeper lesson is not about money; it is about trust, and how easily it can be weaponized through something as simple as a fake job interview.
For every other organization, this attack is a warning that the human element remains the weakest link, and that even the most advanced security systems can be bypassed with the right story. Treat any job offer that asks you to run code on a work computer as a threat. Use separate devices for interviews, especially when the conversation feels too good to be true. Limit what internal AI tools can reach, and keep deployment tokens off laptops entirely. Track changes to account permissions, not just transfers, because the attack was already inside the building before the money moved. And during an incident, plan to both revoke access and rotate keys, because they are separate steps, and skipping one can leave a door open. Finally, give your security operations center the context it needs to stop attacks quickly. Integrate threat intelligence from thousands of sources, not just one feed, because the next attack may look like a friendly recruiter, a helpful coding tool, or an internal AI assistant. The Binance heist was not a single moment of failure. It was a long, patient, and deeply human chain of deception, and the only way to break that chain is to understand how easily trust can be turned into a weapon.