Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops

Attackers stole about USD 6.34 billion from Binance hot wallets on October 29, 2026, an operation the FBI attributes to North Korea and that Binance detailed in an initial report published November 3. The intrusion began in June 2026 when a wallet DevOps engineer installed a tampered Homebrew package for an AI coding tool, and continued in September when a fake recruiter sent a second engineer a take-home assignment whose repository ran malware during setup and replaced pyenv with a malicious copy. In October the attacker used an internal AI tool from that engineer's laptop to reach two wallet engineers, took a container deployment token and signed transactions through the wallet signing service; partners froze or intercepted about USD 2.85 billion and Binance said it covers the loss for users, while stopping 57 other suspected North Korea-linked attempts in 2026.

Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops On this page On October 29, 2026, attackers took about USD 6.34 billion from Binance hot wallets. The attack started on developer laptops, through a tampered Homebrew install and a fake job interview. The Federal Bureau of Investigation FBI attributes it to North Korea DPRK . Binance published its initial report opens in new tab https://x.com/binance/status/2117626126214504729 on November 3, and all facts in this post come from it. TL;DR - About USD 6.34 billion left Binance hot wallets. Partners froze or intercepted about USD 2.85 billion. Binance covers the loss for users. - In June, a wallet DevOps engineer installed a tampered Homebrew package. The attacker learned who works on the wallet team. - In September, a fake recruiter gave a second engineer a take-home assignment. The repository ran malware during setup on a work laptop. - In October, the attacker used an internal AI tool to reach two wallet engineers, took a container deployment token, and signed transactions through the wallet signing service. - Binance stopped 57 other suspected North Korea-linked attempts in 2026. They used fake interviews, fake developer tools, compromised packages and browser extensions. The attack path June 2026 Engineer A Wallet DevOps searches for an AI coding tool installs a tampered Homebrew package - device replaced, credentials rotated - attacker now knows the wallet team September 2026 Engineer B Software Engineer fake recruiter on a job platform interview 1: video call with "HR" interview 2: chat app with "CEO" runs the "assignment" repository on a work laptop - setup step runs malware, pyenv is replaced October 20 attacker uses an internal AI tool from Engineer B's laptop - gains control over Engineer A and Engineer C - finds a container deployment token on Engineer A's machine October 29 17:15-19:56 UTC logs on to Engineer C's computer deploys a container with Engineer A's token runs the attack script 20:05 UTC first unauthorized hot wallet transfers 23:56 UTC last unauthorized transfer 2,961.9 ETH October 30 00:10 UTC EIP-7702 delegation cleared The tampered Homebrew install Engineer A searched for a popular AI coding tool and installed it through a tampered Homebrew installation. Binance links to a SANS Internet Storm Center diary opens in new tab https://isc.sans.edu/diary/32942 for details. Binance’s security team replaced the device and rotated credentials. By then the attacker knew Engineer A’s role and the other engineers on the wallet infrastructure team. The fake job interview Engineer B listed Binance experience on a job platform. A person posing as a Project Director set up two interviews. In the first, an “HR representative” on a video call shared a personal social media account to build trust. The second took place in a chat app with the “CEO” of a company that does not exist. The interviewer then asked Engineer B to download an assignment repository to the work computer. The repository ran malicious code during setup. The malware replaced pyenv with a malicious copy. Binance published these file operations: | Step | Operation | Path | Effect | |---|---|---|---| | 1 | Create | /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv | Staging file next to the real pyenv | | 2 | Modify | libexec/pyenv | Writes the malicious content 3,414 bytes | | 3 | Delete | libexec/pyenv | Removes the real pyenv 3,344 bytes | | 4 | Rename | libexec/pyenv to libexec/pyenv | Puts the malicious copy in its place | | 5 | Delete | /opt/homebrew/bin/pyenv | Removes the pyenv entry on PATH | | 6 | Link | /opt/homebrew/bin/pyenv | Creates a new symlink, then starts a zsh shell | The malicious pyenv ran commands and connected to an attacker server. Endpoint security tools did not detect it. The logged-in user owns /opt/homebrew , so malware that runs as that user can replace any tool there without a password prompt. Contagious Interview Binance does not name a campaign. In SafeDep’s assessment, the interview matches Contagious Interview https://safedep.io/ti/campaigns/contagious-interview , a North Korea-linked campaign that targets developers with fake recruiters and code that runs on install, build or start. SafeDep has documented the same method before: - antd-img-crop OverLord stealer https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer . A forged commit runs a stealer on npm run build . The same payload also came through a fake careers portal. - PolinRider with Ethereum C2 https://safedep.io/blog/polinrider-ethereum-c2-github-repositories . 35 GitHub repositories carry a loader that runs when a developer builds or starts the project. - Astro configuration file with blockchain C2 https://safedep.io/blog/astro-config-blockchain-c2-supply-chain . A pull request that hides the loader in a build configuration file. From one laptop to the wallets Engineer B laptop malware │ ▼ internal AI tool ──► Engineer A laptop ──► container deployment token ──► Engineer C laptop │ │ │ ▼ ▼ attacker logs on, deploys a container │ ▼ internal wallet signing service │ ▼ hot wallet transfers + EIP-7702 delegation Binance does not say how the internal AI tool gave control over other engineers’ computers. The attacker used the wallet signing service to send transactions outside the normal withdrawal process. It also signed 50 transactions to set up an EIP-7702 Ethereum Improvement Proposal 7702 delegation. That delegation gave an attacker contract partial control of a hot wallet, and it stayed active on-chain after Binance stopped withdrawals. The hot wallet uses Multi-Party Computation MPC , so Binance had no single private key to sign a fast revocation. Sources - Binance, Initial Findings and Response Update opens in new tab https://x.com/binance/status/2117626126214504729 on X, published November 3, 2026 - FBI, North Korea responsible for $6 billion Binance attack opens in new tab https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack - SafeDep, October 2026 Security Incident Review https://safedep.io/blog/october-2026-security-incident-review - supply-chain - incident - contagious-interview - north-korea - developer-security Author safedep.io