The Binance hack unfolded over several months rather than through one isolated phishing attempt. Attackers poisoned a development package, impersonated recruiters and persuaded engineers to execute malware. Those compromises ultimately opened a path to the exchange’s wallet-signing infrastructure.
At a glance:
- Binance estimates that approximately $6.34 billion in digital assets were affected in the October 29 incident.
- The operation began in June 2026, when a Wallet DevOps engineer obtained a manipulated Homebrew installation.
- Fake recruitment interviews in September led another engineer to execute a malicious technical assignment.
- The FBI attributed the incident to North Korea-linked TraderTraitor, also tracked as Lazarus Group and APT38.
- Binance suspended withdrawals and froze affected assets, although some transfers continued for several hours.
The first foothold targeted a developer tool
The intrusion initially exploited software used for engineering work rather than customer accounts.
Security Affairs reports that a Wallet DevOps engineer found a tampered Homebrew package in June 2026 while looking for an AI-assisted coding tool. After identifying suspicious behavior, Binance replaced the affected computer and changed the associated credentials. The attacker nevertheless retained intelligence about the engineer and the identities of his colleagues.
Blockonomi says the manipulated version was promoted through an advertisement, placing it ahead of the legitimate tool in search results. Whatever route led to the download, the outcome was a compromised package inside an otherwise familiar installation process.
This form of attack makes simple website blocking insufficient. Defenders must also verify where development packages originate, what those packages are permitted to execute and which systems their users can access.
Recruitment fraud produced another malware infection
The next stage targeted an engineer seeking work.
The attacker approached the employee through a legitimate job-hunting platform and constructed a fictional company around a project-director identity. One video session featured a supposed human-resources representative, who used personal photographs and videos to make the interaction appear genuine. A later session ended with a request to download and run a technical assignment from a code repository.
The assignment contained malware that activated during installation. It substituted a legitimate development component with a hostile version, concealed its activity through obfuscation and connected with infrastructure controlled by the attacker. According to Binance, endpoint-security products failed to identify it.
The engineer had a plausible professional reason to run the repository. That made the recruitment story more than a disguise: it supplied the context needed for the target to install attacker-controlled code voluntarily.
Compromised tools opened the path to wallet operations
The malware gave the attackers command execution on developer systems. They subsequently abused a compromised internal AI application and information from the first engineer’s machine to obtain credentials connected to wallet infrastructure.
AI-assisted development tools deserve particular scrutiny because they may sit close to source code, deployment workflows and stored secrets. When permissions are broad, compromising one such tool can expose several connected systems at once. Productivity and authorization cannot safely occupy the same unrestricted environment.
On October 29, stolen credentials allowed attackers to execute a malicious script and reach the wallet signing service. Blockonomi reports that 233.46 million XRP moved from five hot wallets in four minutes, followed by withdrawals involving other cryptocurrencies, including bitcoin.
Binance responded by suspending withdrawals, freezing affected tokens and revoking unauthorized permissions. The exchange says it froze about $2.85 billion in assets. Yet the incident continued after those measures began, with the final reported unauthorized transfer occurring nearly four hours after the attack started.
That delay illustrates why containment requires more than freezing known balances. Operators must also identify every outstanding authorization, revoke it and confirm that the revoked access cannot be restored from another compromised system.
Why it matters
The breach combined several familiar weaknesses into a single path to financial infrastructure: recruitment impersonation, developer-tool tampering, internal-tool compromise, credential theft and inadequate separation between engineering access and transaction approval.
The key defensive question is whether one developer account can authorize wallet activity by itself. If it can, attackers need only compromise an endpoint to create a financial-control failure. Stronger separation makes additional approvals, credentials or systems mandatory before assets can move.
The intrusion was also unusually broad. Its targets were engineers, its delivery methods were trusted software and job-related communications, and its objective reached the exchange’s signing infrastructure. Because endpoint controls missed the malware, package verification, execution restrictions, credential isolation and privileged-access controls all had to work together.
| Intrusion phase | What the attackers exploited | What defenders should prioritize |
|---|---|---|
| Development software | A manipulated package reached an engineer’s computer. | Verify package origins and limit developer-workstation privileges. |
| Recruitment process | Fake interviewers prompted an engineer to execute an assignment. | Monitor recruitment contacts and code run during hiring exercises. |
| Internal AI tooling | Compromised tooling exposed credentials and deployment access. | Restrict stored data, connected services and executable permissions. |
| Wallet infrastructure | Stolen credentials enabled unauthorized signing activity. | Separate identity access, approval rights and transaction authority. |
What to watch next
The remaining assets and any further recovery from the approximately $2.85 billion Binance froze will show how much damage was contained. Attention should also remain on the exchange’s internal AI permissions, container deployment controls and wallet authorization structure.
The FBI’s attribution to TraderTraitor is significant, although Blockonomi reports that Pyongyang denies responsibility. Attribution alone cannot indicate whether attackers are copying the full sequence or selecting individual techniques for future operations.
The immediate risk is reuse. Recruitment lures can make hostile code look like ordinary professional work while revealing useful details about a target. Manipulated developer tools can remain persuasive because their placement appears normal inside the software supply chain.
Binance described the operation as a sophisticated, multi-stage campaign. The evidence supports that description: several footholds created the conditions for the next, and the eventual theft came from a connected intrusion rather than one mistaken click.
Key takeaways
- Treat developer workstations and recruitment interactions as security-sensitive attack surfaces.
- Keep code execution, credential access and transaction approval on separate systems.
- Monitor package provenance, cross-user access and unusual privileged deployment activity.
- Do not depend on endpoint detection when attackers can alter trusted development components.
- Treat every stolen authorization as active until it has been revoked and independently verified.
Frequently asked questions
How much was stolen in the Binance hack?
Binance estimates that approximately $6.34 billion in digital assets were affected. It says about $2.85 billion had been frozen as of November 3.
Who does the FBI blame for the attack?
The FBI attributed the incident to North Korea-linked TraderTraitor, also tracked as Lazarus Group and APT38. Blockonomi reports that Pyongyang rejects the claim.
How did the attackers reach Binance engineers?
One engineer downloaded manipulated developer software in June 2026. Another was approached through a fabricated recruitment process in September and executed a technical assignment containing malware.
Why did transfers continue after Binance suspended withdrawals?
Suspending withdrawals did not terminate every outstanding authorization. Binance also established procedures for revoking permissions, while unauthorized transfers continued for nearly four hours.
What should security teams do first?
Map connections among developer identities, secrets, container systems and production signing services. Remove unnecessary standing access, require independent approval for sensitive actions and alert on cross-user access or unexpected software execution.