# Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops > Source: > Published: 2026-11-03 15:00:00+00:00 # Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops On this page On October 29, 2026, attackers took about USD 6.34 billion from Binance hot wallets. The attack started on developer laptops, through a tampered Homebrew install and a fake job interview. The Federal Bureau of Investigation (FBI) attributes it to North Korea (DPRK). Binance published its [initial report(opens in new tab)](https://x.com/binance/status/2117626126214504729) on November 3, and all facts in this post come from it. ## TL;DR - About USD 6.34 billion left Binance hot wallets. Partners froze or intercepted about USD 2.85 billion. Binance covers the loss for users. - In June, a wallet DevOps engineer installed a tampered Homebrew package. The attacker learned who works on the wallet team. - In September, a fake recruiter gave a second engineer a take-home assignment. The repository ran malware during setup on a work laptop. - In October, the attacker used an internal AI tool to reach two wallet engineers, took a container deployment token, and signed transactions through the wallet signing service. - Binance stopped 57 other suspected North Korea-linked attempts in 2026. They used fake interviews, fake developer tools, compromised packages and browser extensions. ## The attack path ``` June 2026 Engineer A (Wallet DevOps) searches for an AI coding tool installs a tampered Homebrew package -> device replaced, credentials rotated -> attacker now knows the wallet team September 2026 Engineer B (Software Engineer) fake recruiter on a job platform interview 1: video call with "HR" interview 2: chat app with "CEO" runs the "assignment" repository on a work laptop -> setup step runs malware, pyenv is replaced October 20 attacker uses an internal AI tool from Engineer B's laptop -> gains control over Engineer A and Engineer C -> finds a container deployment token on Engineer A's machine October 29 17:15-19:56 UTC logs on to Engineer C's computer deploys a container with Engineer A's token runs the attack script 20:05 UTC first unauthorized hot wallet transfers 23:56 UTC last unauthorized transfer (2,961.9 ETH) October 30 00:10 UTC EIP-7702 delegation cleared ``` ## The tampered Homebrew install Engineer A searched for a popular AI coding tool and installed it through a tampered Homebrew installation. Binance links to a [SANS Internet Storm Center diary(opens in new tab)](https://isc.sans.edu/diary/32942) for details. Binance’s security team replaced the device and rotated credentials. By then the attacker knew Engineer A’s role and the other engineers on the wallet infrastructure team. ## The fake job interview Engineer B listed Binance experience on a job platform. A person posing as a Project Director set up two interviews. In the first, an “HR representative” on a video call shared a personal social media account to build trust. The second took place in a chat app with the “CEO” of a company that does not exist. The interviewer then asked Engineer B to download an assignment repository to the work computer. The repository ran malicious code during setup. The malware replaced `pyenv` with a malicious copy. Binance published these file operations: | Step | Operation | Path | Effect | |---|---|---|---| | 1 | Create | `/opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_` | Staging file next to the real `pyenv` | | 2 | Modify | `libexec/pyenv_` | Writes the malicious content (3,414 bytes) | | 3 | Delete | `libexec/pyenv` | Removes the real `pyenv` (3,344 bytes) | | 4 | Rename | `libexec/pyenv_` to`libexec/pyenv` | Puts the malicious copy in its place | | 5 | Delete | `/opt/homebrew/bin/pyenv` | Removes the `pyenv` entry on`PATH` | | 6 | Link | `/opt/homebrew/bin/pyenv` | Creates a new symlink, then starts a `zsh` shell | The malicious `pyenv` ran commands and connected to an attacker server. Endpoint security tools did not detect it. The logged-in user owns `/opt/homebrew`, so malware that runs as that user can replace any tool there without a password prompt. ## Contagious Interview Binance does not name a campaign. In SafeDep’s assessment, the interview matches [Contagious Interview](https://safedep.io/ti/campaigns/contagious-interview), a North Korea-linked campaign that targets developers with fake recruiters and code that runs on install, build or start. SafeDep has documented the same method before: - [antd-img-crop OverLord stealer](https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer) . A forged commit runs a stealer on`npm run build` . The same payload also came through a fake careers portal. - [PolinRider with Ethereum C2](https://safedep.io/blog/polinrider-ethereum-c2-github-repositories) . 35 GitHub repositories carry a loader that runs when a developer builds or starts the project. - [Astro configuration file with blockchain C2](https://safedep.io/blog/astro-config-blockchain-c2-supply-chain) . A pull request that hides the loader in a build configuration file. ## From one laptop to the wallets ``` Engineer B laptop (malware) │ ▼ internal AI tool ──► Engineer A laptop ──► container deployment token ──► Engineer C laptop │ │ │ ▼ ▼ attacker logs on, deploys a container │ ▼ internal wallet signing service │ ▼ hot wallet transfers + EIP-7702 delegation ``` Binance does not say how the internal AI tool gave control over other engineers’ computers. The attacker used the wallet signing service to send transactions outside the normal withdrawal process. It also signed 50 transactions to set up an EIP-7702 (Ethereum Improvement Proposal 7702) delegation. That delegation gave an attacker contract partial control of a hot wallet, and it stayed active on-chain after Binance stopped withdrawals. The hot wallet uses Multi-Party Computation (MPC), so Binance had no single private key to sign a fast revocation. ## Sources - Binance, [Initial Findings and Response Update(opens in new tab)](https://x.com/binance/status/2117626126214504729) on X, published November 3, 2026 - FBI, [North Korea responsible for $6 billion Binance attack(opens in new tab)](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) - SafeDep, [October 2026 Security Incident Review](https://safedep.io/blog/october-2026-security-incident-review) - supply-chain - incident - contagious-interview - north-korea - developer-security Author safedep.io