Binance details attack behind $6.43 billion theft

Binance said the first stage began in June 2026 when Engineer A, who worked on its Wallet DevOps team, downloaded a trojanised Homebrew installer while searching for an AI tool. Binance said it detected that activity and rotated related credentials, but that details about his role and nearby colleagues on the wallet infrastructure team were exposed.

A second stage followed in September 2026, when the threat actor contacted Engineer B through a job-hunting platform while posing as a Project Director. Binance said the process moved through a first video interview with an HR representative and then a second round with a person claiming to be the chief executive of a company that did not exist.

Binance said Engineer B was later told to download an assignment containing a malicious repository onto his work machine. The company said the code ran during setup, used obfuscation and evasion methods, and then removed forensic traces.

According to Binance, the intrusion later reached Engineer B’s compromised computer and an internal AI tool was used to gain access to Engineer A and Engineer C. The company said the attacker found a container deployment token on Engineer A’s computer, then used stolen credentials to deploy a container and launch a malicious script on 29 October between 17:15 and 19:56.

Binance said the attack ended with unauthorised use of an internal wallet signing service to make transactions outside the normal withdrawal path. It said it had rebuilt the affected wallet system, replaced devices and credentials, tightened device and risk controls, and increased investment in detection and monitoring; it also said it had foiled 57 suspected North Korea-linked cyber threat cases this year.