{"slug": "binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops", "title": "Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops", "summary": "Attackers stole about USD 6.34 billion from Binance hot wallets on October 29, 2026, an operation the FBI attributes to North Korea and that Binance detailed in an initial report published November 3. The intrusion began in June 2026 when a wallet DevOps engineer installed a tampered Homebrew package for an AI coding tool, and continued in September when a fake recruiter sent a second engineer a take-home assignment whose repository ran malware during setup and replaced pyenv with a malicious copy. In October the attacker used an internal AI tool from that engineer's laptop to reach two wallet engineers, took a container deployment token and signed transactions through the wallet signing service; partners froze or intercepted about USD 2.85 billion and Binance said it covers the loss for users, while stopping 57 other suspected North Korea-linked attempts in 2026.", "body_md": "# Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops\n\nOn this page\n\nOn October 29, 2026, attackers took about USD 6.34 billion from Binance hot wallets. The attack started on developer\nlaptops, through a tampered Homebrew install and a fake job interview. The Federal Bureau of Investigation (FBI)\nattributes it to North Korea (DPRK). Binance published its\n[initial report(opens in new tab)](https://x.com/binance/status/2117626126214504729) on November 3, and all facts in this post come from\nit.\n\n## TL;DR\n\n- About USD 6.34 billion left Binance hot wallets. Partners froze or intercepted about USD 2.85 billion. Binance covers the loss for users.\n- In June, a wallet DevOps engineer installed a tampered Homebrew package. The attacker learned who works on the wallet team.\n- In September, a fake recruiter gave a second engineer a take-home assignment. The repository ran malware during setup on a work laptop.\n- In October, the attacker used an internal AI tool to reach two wallet engineers, took a container deployment token, and signed transactions through the wallet signing service.\n- Binance stopped 57 other suspected North Korea-linked attempts in 2026. They used fake interviews, fake developer tools, compromised packages and browser extensions.\n\n## The attack path\n\n```\nJune 2026            Engineer A (Wallet DevOps)\n                     searches for an AI coding tool\n                     installs a tampered Homebrew package\n                     -> device replaced, credentials rotated\n                     -> attacker now knows the wallet team\n\nSeptember 2026       Engineer B (Software Engineer)\n                     fake recruiter on a job platform\n                     interview 1: video call with \"HR\"\n                     interview 2: chat app with \"CEO\"\n                     runs the \"assignment\" repository on a work laptop\n                     -> setup step runs malware, pyenv is replaced\n\nOctober 20           attacker uses an internal AI tool from Engineer B's laptop\n                     -> gains control over Engineer A and Engineer C\n                     -> finds a container deployment token on Engineer A's machine\n\nOctober 29           17:15-19:56 UTC  logs on to Engineer C's computer\n                                      deploys a container with Engineer A's token\n                                      runs the attack script\n                     20:05 UTC        first unauthorized hot wallet transfers\n                     23:56 UTC        last unauthorized transfer (2,961.9 ETH)\n\nOctober 30           00:10 UTC  EIP-7702 delegation cleared\n```\n\n## The tampered Homebrew install\n\nEngineer A searched for a popular AI coding tool and installed it through a tampered Homebrew installation. Binance\nlinks to a [SANS Internet Storm Center diary(opens in new tab)](https://isc.sans.edu/diary/32942) for details. Binance’s security team\nreplaced the device and rotated credentials. By then the attacker knew Engineer A’s role and the other engineers on\nthe wallet infrastructure team.\n\n## The fake job interview\n\nEngineer B listed Binance experience on a job platform. A person posing as a Project Director set up two interviews. In the first, an “HR representative” on a video call shared a personal social media account to build trust. The second took place in a chat app with the “CEO” of a company that does not exist. The interviewer then asked Engineer B to download an assignment repository to the work computer. The repository ran malicious code during setup.\n\nThe malware replaced `pyenv` with a malicious copy. Binance published these file operations:\n\n| Step | Operation | Path | Effect | \n|---|---|---|---|\n| 1 | Create | `/opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_` | Staging file next to the real `pyenv` | \n| 2 | Modify | `libexec/pyenv_` | Writes the malicious content (3,414 bytes) | \n| 3 | Delete | `libexec/pyenv` | Removes the real `pyenv` (3,344 bytes) | \n| 4 | Rename | `libexec/pyenv_` to`libexec/pyenv` | Puts the malicious copy in its place | \n| 5 | Delete | `/opt/homebrew/bin/pyenv` | Removes the `pyenv` entry on`PATH` | \n| 6 | Link | `/opt/homebrew/bin/pyenv` | Creates a new symlink, then starts a `zsh` shell | \n\nThe malicious `pyenv` ran commands and connected to an attacker server. Endpoint security tools did not detect it.\nThe logged-in user owns `/opt/homebrew`, so malware that runs as that user can replace any tool there without a\npassword prompt.\n\n## Contagious Interview\n\nBinance does not name a campaign. In SafeDep’s assessment, the interview matches\n[Contagious Interview](https://safedep.io/ti/campaigns/contagious-interview), a North Korea-linked campaign that targets developers with\nfake recruiters and code that runs on install, build or start. SafeDep has documented the same method before:\n\n- [antd-img-crop OverLord stealer](https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer) . A forged commit runs a stealer\non`npm run build` . The same payload also came through a fake careers portal.\n- [PolinRider with Ethereum C2](https://safedep.io/blog/polinrider-ethereum-c2-github-repositories) . 35 GitHub repositories carry a loader\nthat runs when a developer builds or starts the project.\n- [Astro configuration file with blockchain C2](https://safedep.io/blog/astro-config-blockchain-c2-supply-chain) . A pull request that\nhides the loader in a build configuration file.\n\n## From one laptop to the wallets\n\n```\nEngineer B laptop (malware)\n   │\n   ▼\ninternal AI tool  ──►  Engineer A laptop  ──►  container deployment token\n                  ──►  Engineer C laptop               │\n                            │                          │\n                            ▼                          ▼\n                     attacker logs on, deploys a container\n                                   │\n                                   ▼\n                     internal wallet signing service\n                                   │\n                                   ▼\n               hot wallet transfers + EIP-7702 delegation\n```\n\nBinance does not say how the internal AI tool gave control over other engineers’ computers. The attacker used the wallet signing service to send transactions outside the normal withdrawal process. It also signed 50 transactions to set up an EIP-7702 (Ethereum Improvement Proposal 7702) delegation. That delegation gave an attacker contract partial control of a hot wallet, and it stayed active on-chain after Binance stopped withdrawals. The hot wallet uses Multi-Party Computation (MPC), so Binance had no single private key to sign a fast revocation.\n\n## Sources\n\n- Binance, [Initial Findings and Response Update(opens in new tab)](https://x.com/binance/status/2117626126214504729) on X, published\nNovember 3, 2026\n- FBI,\n[North Korea responsible for $6 billion Binance attack(opens in new tab)](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack)\n- SafeDep, [October 2026 Security Incident Review](https://safedep.io/blog/october-2026-security-incident-review)\n\n- supply-chain\n- incident\n- contagious-interview\n- north-korea\n- developer-security\n\nAuthor\n\nsafedep.io", "url": "https://wpnews.pro/news/binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops", "canonical_source": "https://safedep.io/blog/binance-hack-developer-supply-chain-attack-path", "published_at": "2026-11-03 15:00:00+00:00", "updated_at": "2026-11-03 17:25:13.869634+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Binance", "Federal Bureau of Investigation", "North Korea", "Homebrew", "pyenv", "SANS Internet Storm Center"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops", "markdown": "https://wpnews.pro/news/binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops.md", "text": "https://wpnews.pro/news/binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops.txt", "jsonld": "https://wpnews.pro/news/binance-hack-how-attackers-stole-6-34-billion-through-developer-laptops.jsonld"}}