Overview
Binance published its first incident report on November 3, 2026, tracing a record $6.34 billion theft to a months-long campaign that compromised the computers of three wallet engineers, per SecurityWeek. The FBI attributes the theft to TraderTraitor, a North Korean state-sponsored group. North Korea has rejected the attribution.
Attack Timeline
| When | What happened |
|---|---|
| June | A Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for a popular AI coding tool. Binance caught it, replaced the device and reset credentials, but the attackers had already learned about the engineer's work and colleagues. |
| September | A second engineer was approached by a fake project director, interviewed twice (including a fake HR representative and an alleged CEO of a nonexistent company), then asked to download a coding "assignment" hiding a malicious repository. The zero-day malware was not detected by endpoint protection at the time. |
| October 20 | Attackers used the infected machine and an internal AI tool to take over the first engineer's system and a third wallet engineer's system. The report does not explain how the AI tool was used. |
| October 29 | Attackers signed into the third engineer's computer, deployed a container with credentials taken from the first engineer, and launched the attack with a malicious script. |
The Theft
The attackers used unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of hot wallets. They also abused Ethereum's EIP-7702 mechanism to give a contract they controlled partial execution rights over a hot wallet. Because the wallet used multi-party computation, Binance had no single key to cancel the delegation immediately. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.
Aftermath
- About $2.85 billion has been frozen or intercepted; Elliptic estimated roughly $3.18 billion remained in theft-linked addresses as of November 3
- Funds moved through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions
- Withdrawals began reopening in phases on November 1
- Binance says it rebuilt the affected wallet system and AI tool, replaced devices, retired engineers' credentials and tokens, and is engaging independent security firms
- Co-CEO Richard Teng says 98% of impacted tokens have been replenished
Lessons for Defenders
- Treat "coding assignments" and interview tasks from unknown parties as hostile; run them only in disposable, isolated environments.
- Verify the source of developer tools, including package-manager installers, before installing.
- Limit what internal AI tools can reach and what credentials they can use, and log their actions.
- Segment signing infrastructure so one engineer's workstation cannot reach it.
- Plan for rapid revocation of delegated permissions, including account-abstraction and delegation mechanisms.