Binance says North Korean-linked attackers spent months combining social engineering, a supply-chain compromise and abuse of an internal AI tool before the October 29, 2026 theft. One engineer downloaded a tampered Homebrew version while installing an AI coding tool, while another was targeted through fake interviews and a malicious coding assignment. The attackers used the resulting access and stolen credentials to reach employees involved in wallet operations, deploy a container and trigger the attack. They then abused Binance’s wallet-signing service and Ethereum’s EIP-7702 authorization mechanism, contributing to the theft of approximately $6.34 billion in digital assets. Binance says it is absorbing the loss and that the investigation remains ongoing.
Why it matters
The incident illustrates how recruitment scams, poisoned developer software, internal AI systems and privileged wallet infrastructure can form a single attack path. Security programs should treat employee devices, development tooling, AI assistants, credentials and transaction-signing systems as connected risks rather than isolated controls.
Key points
- The theft occurred on October 29, 2026, and Binance estimated that approximately $6.34 billion in virtual assets were affected.
- Binance’s account describes months of preparation, including a tampered Homebrew download and later compromises involving employees and internal tooling.
- The campaign included fake recruitment interviews and a malicious coding assignment delivered to an employee’s work computer.
- The tampered Homebrew download was used to install an AI coding tool; Binance separately described fake developer-tool software and other North Korea-linked techniques.
- Attackers used stolen credentials and container access to reach Binance’s wallet-signing service, then exploited transaction-authorization mechanisms to move funds.
Based on reporting by The original announcement, Tom's Hardware and Ars Technica.
Join the conversation! Your thoughts help the community grow.