Binance has revealed new details about the massive $6.43 billion cryptocurrency theft, describing the incident as a sophisticated, multi-stage cyberattack involving malicious software, fake recruitment interviews, compromised internal AI tools, and unauthorized access to its wallet infrastructure.
The world’s largest cryptocurrency exchange said on Tuesday that the attack was not the result of a single security breach or conventional phishing campaign. Instead, attackers combined multiple techniques to compromise employees and eventually bypass the company’s normal transaction authorization procedures.
According to Binance, the attackers targeted two engineers through separate social engineering campaigns before exploiting compromised devices, stolen credentials, and internal development tools to gain access to critical wallet systems.
“It was not a single isolated breach or a simple phishing incident,” Binance said, explaining that the operation involved fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction authorization method.
Attack Began With a Malicious Homebrew Installer
Binance traced the first stage of the attack to June 2026, when a member of its Wallet DevOps team, identified as Engineer A, downloaded a tampered Homebrew installer while searching for a popular artificial intelligence (AI) tool through a search engine.
The malicious installer was designed to compromise the engineer’s development environment as part of a supply chain attack.
Binance said it detected the incident and took precautionary measures, including rotating all associated credentials. However, the attackers had already obtained information about Engineer A’s responsibilities and colleagues working within the company’s wallet infrastructure team.
This exposed internal organizational information that could help the attackers identify additional employees and plan subsequent stages of the operation.
Hackers Used Fake Job Interviews to Target Another Engineer
The second phase began in September 2026, when the threat actor approached another Binance engineer, identified as Engineer B, through a legitimate job-search platform.
The attacker impersonated a Project Director and initiated a recruitment process designed to establish trust with the employee.
The operation involved two interview rounds:
- First interview: A person claiming to represent the human resources (HR) department conducted an initial video interview and shared a social media account containing personal photographs and videos to appear legitimate.
- Second interview: Another individual, posing as the CEO of a non-existent company, conducted a follow-up interview through a popular messaging and social networking application.
Binance said the fake recruitment process was carefully designed to convince the targeted employee that the opportunity was genuine.
Near the end of the second interview, Engineer B was instructed to download an assignment containing a malicious code repository onto his work computer.
“The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities,” Binance explained.
Malware Used Advanced Evasion Techniques
Once executed, the malicious repository installed malware that used multiple techniques to avoid detection and maintain unauthorized access.
According to Binance, the attackers employed advanced code obfuscation and evasion methods. One technique involved replacing a legitimate component of a development tool with a malicious version.
This allowed the attackers to execute unauthorized commands and establish communication with an external server under their control.
The threat actor also attempted to conceal evidence of the compromise by deleting forensic artifacts that could have helped investigators identify the intrusion.
These techniques enabled the attackers to maintain access while making it more difficult for security teams to detect and investigate their activities.
Attackers Abused Internal AI Tools to Expand Access
The intrusion escalated on October 20, 2026, when attackers used Engineer B’s compromised computer and abused an internal AI tool to gain control over Engineer A and another wallet software engineer, identified as Engineer C.
During the investigation, Binance discovered that Engineer A’s computer contained a container deployment permission token.
This credential became a critical component of the subsequent attack.
According to Binance, the attackers obtained access to the credentials associated with Engineer A and used them to compromise Engineer C’s computer.
On October 29, between 17:15 and 19:56, the attackers logged into Engineer C’s machine, used the stolen credentials, deployed a container, and executed a malicious script to initiate the next stage of the operation.
“The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer,” Binance explained.
Hackers Exploited Internal Wallet Signing Infrastructure
The final stage of the attack involved exploiting unauthorized access to Binance’s internal wallet signing service.
Rather than following the exchange’s standard withdrawal authorization procedures, the attackers used their access to initiate cryptocurrency transactions outside the normal process.
This ultimately enabled the theft of assets valued at approximately $6.43 billion, according to the incident figures provided in Binance’s disclosure.
The incident highlights how compromising employee devices, stealing internal credentials, and abusing trusted development infrastructure can create a pathway toward highly sensitive financial systems.
It also demonstrates the risks associated with excessive permissions and the potential security implications of integrating AI-powered tools into internal development environments.
Binance Rebuilds Affected Systems Following the Attack
Following the incident, Binance said it implemented several security measures to contain the threat, restore affected infrastructure, and prevent similar attacks.
As of November 3, the company reported completing the following actions:
- Replaced affected devices: Compromised employee devices were replaced to eliminate potential persistence mechanisms.
- Revoked compromised credentials: Credentials and access tokens associated with affected engineers were decommissioned.
- Conducted security scans: Enhanced security scans were completed across employee devices.
- Rebuilt internal AI infrastructure: The affected internal AI tool and its associated access controls were rebuilt.
- Strengthened wallet security: Additional risk controls were introduced to protect internal wallet services.
- Improved AI-based detection: Behavioural anomaly detection capabilities were enhanced to identify suspicious activities.
- Coordinated asset recovery efforts: Binance worked with law enforcement agencies, blockchain intelligence companies, and industry partners to trace and freeze affected assets.
The company also reconstructed the affected wallet system in a new environment to reduce the risk of further unauthorized access.
“The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced,” Binance said.
The exchange added that it plans to increase investment in AI-enabled threat detection, endpoint security, developer environment protection, and behavioural anomaly monitoring.
Binance Reports 57 Suspected North Korea-Linked Cyber Threat Cases
The incident comes amid continued cyber threats targeting cryptocurrency exchanges and blockchain-related businesses.
Binance said it had prevented 57 suspected cyber threat cases linked to North Korea since the beginning of 2026.
According to the company, these campaigns frequently rely on social engineering and malicious software disguised as legitimate applications and developer tools.
The techniques identified include:
- Fraudulent recruitment interviews targeting cryptocurrency industry employees.
- Malicious software disguised as popular developer applications.
- Compromised software packages and browser extensions.
- Fake video conferencing applications.
- Social engineering campaigns designed to steal credentials.
- Malware deployments intended to establish remote access to compromised systems.
These incidents demonstrate the growing sophistication of cybercriminal operations targeting cryptocurrency companies.
Conclusion
The $6.43 billion Binance incident illustrates how a cyberattack can progress from a seemingly harmless software download to a compromise of critical financial infrastructure.
By combining supply chain attacks, fake recruitment campaigns, compromised employee devices, stolen credentials, and abuse of internal AI tools, the attackers were able to navigate multiple layers of the exchange’s security environment.
Binance says it has rebuilt affected systems, revoked compromised credentials, strengthened wallet protections, and expanded its threat detection capabilities.
However, the incident serves as an important reminder that cybersecurity risks extend beyond traditional network vulnerabilities. Employee security awareness, software supply chain protection, strict access controls, and continuous monitoring of internal tools are equally important in protecting cryptocurrency platforms from sophisticated attacks.
