Binance, the world's largest cryptocurrency trading platform, disclosed additional details about a historic cyberattack that caused the company to lose digital assets valued at up to $6.3 billion, approximately 200 billion baht. The attackers spent several months planning and infiltrating the system through company engineers before gaining access to the internal system responsible for signing and approving transactions from digital asset wallets.
, Binance stated that this incident was not merely a single system breach or a common phishing scam, but a complex, multi-step operation. It combined social engineering techniques such as fake job interviews, downloading malicious software, exploiting internal AI tools, gaining control over employee devices, and advanced transaction approval methods, leading to the theft of cryptocurrency worth billions of dollars.
The attack began in June 2026 when a Binance Wallet DevOps engineer, referred to as Engineer A, searched for popular AI tools online to download. Unknowingly, the engineer downloaded a Trojanized Homebrew installer containing hidden malware.
Homebrew is a widely used software management and installation tool among developers, especially on macOS. This attack through a tampered installer is a form of a software supply chain attack.
Although Binance detected the attack and changed all related credentials to mitigate risk, information about Engineer A’s role and colleagues involved with the digital asset wallet infrastructure leaked to the hackers. This allowed the attackers to precisely identify key personnel responsible for Binance’s crypto wallet system.
The second phase occurred in September 2026, targeting another engineer, Engineer B. The attackers contacted this engineer via a legitimate job platform, reportedly LinkedIn, impersonating a project director from a company.
They arranged an initial interview with a person claiming to be an HR officer.
During a video interview, the fake HR representative shared social media accounts featuring personal photos and videos to build credibility and convince the engineer that the company was real.
They then scheduled a second interview via a popular chat application with someone posing as the company’s CEO, though the company itself was fictitious.
At the end of the second interview, Engineer B was instructed to download a programming assignment onto their work computer. The assignment contained hidden malicious code designed to execute during software installation and configuration.
The malware used obfuscation and evasion techniques to conceal its harmful behavior and avoid detection. One method involved replacing legitimate software development tool components with versions embedded with malicious code.
This technique allowed hackers to execute commands on the computer and establish connections to external servers controlled by the attackers. They also attempted to erase digital footprints related to the intrusion to hinder forensic investigation.
After gaining control of Engineer B’s computer, the attackers escalated their operation on 20 October 2026.
Using Engineer B’s compromised computer and Binance’s internal AI tools, the hackers took control of two additional engineers’ computers: Engineer A from the Wallet DevOps team and Engineer C, a software engineer involved with the crypto wallet system. However, Binance has not disclosed technical details on how the AI tools were breached or how the attackers leveraged AI capabilities to access and control these devices.
During the attack, hackers discovered that Engineer A’s computer contained a Container Deployment Permission Token, which grants rights to deploy and run software in the organization’s container systems. This token became critical data that allowed attackers to use the engineer’s permissions to operate within internal systems.
Reports indicate that on 29 October 2026, between 17:15 and 19:56 (as per the report’s timestamp), the hackers accessed Engineer C’s computer.
They then used credentials stolen from Engineer A to install containers and execute malicious scripts to begin attacking Binance’s digital asset wallet system.
The crucial point of this attack was that the hackers gained unauthorized access to the internal Wallet Signing Service, which is responsible for digitally signing and approving digital asset transactions, a key step in authorizing crypto movements out of wallets.
Access to this service allowed the attackers to initiate transactions bypassing the platform’s standard withdrawal processes, resulting in the theft of digital assets valued at around $6.3 billion.
The attack forced Binance to temporarily suspend digital asset withdrawal services for global customers on 29 October, preventing users from withdrawing crypto from the platform. The company later allocated funds exceeding 100% of the stolen asset value for compensation and managed to restore approximately 98% of the affected assets by Saturday, 31 October. The service resumed on Sunday, 1 November.
Following the incident, Binance implemented recovery measures and enhanced security for affected systems, including rebuilding the digital asset wallet system in an environment separate from the previous system and redeveloping internal AI tools and access control systems.
Additional measures as of 3 November include:
Binance confirmed it has closed the entry points used by the attackers. Systems involved in the attack vector have been rebuilt or replaced, with stricter controls over devices and internal system access rights.
U.S. law enforcement agencies, including the FBI and the U.S. Secret Service, assisted Binance in tracking the movement of stolen digital assets from the platform’s wallets.
These agencies, along with several cybersecurity analysts, indicated that the attack bears hallmarks consistent with hacker groups linked to North Korea, which have been accused of multiple large-scale cryptocurrency thefts.
One well-known group is TraderTraitor, believed to be connected to Lazarus Group, which was blamed for the 2025 Bybit platform attack that stole approximately $1.5 billion in digital assets—the largest crypto heist at that time.
Regarding the recent Binance incident, the company stated via X that the latest information from the FBI points to the Democratic People’s Republic of Korea (North Korea) as responsible for the attack.
However, the North Korean government denied the allegations. Kim Yo Jong, a senior North Korean official and sister to leader Kim Jong Un, described the accusations as another malicious U.S. attempt to tarnish North Korea’s image.
What makes this incident notable is that the hackers did not start by attacking the crypto wallet system directly but spent months gradually infiltrating the information and devices of personnel linked to critical systems.
This included disguising malware-laden AI tool installers, creating a fake company to conduct job interviews, embedding malware in programming tests, and exploiting compromised internal AI tools to extend control to other engineers.
Ultimately, the attackers stole credentials and tokens with software deployment rights, enabling access to the transaction signing service of the crypto wallet—a pivotal point allowing asset transfers outside normal withdrawal procedures.
This case highlights growing risks associated with internal AI use, especially when such tools connect to sensitive data, software development systems, or employee devices with access to critical infrastructure, alongside vulnerabilities in managing access rights within key infrastructure.
The incident reflects challenges faced by the tech and digital finance industries in the AI era, where the same tools that enhance productivity can also provide malicious actors pathways into vital organizational systems, leading to the largest digital asset theft in history.
Sources Fortune , Bloomberg , The Hacker News
For stock and investment news, follow Thairath Money to help you achieve "Good Finance, Good Life" at https://www.thairath.co.th/money/investment
Follow the Facebook page: Thairath Money at this link https://www.facebook.com/ThairathMoney