Binance has described the theft of $6.43 billion in assets as the result of a multi-stage campaign involving social engineering, malicious software and compromised internal tools. The company said the attackers targeted two engineers and ultimately accessed an internal wallet signing service to initiate transactions outside the normal withdrawal process.
The first stage began in June 2026, when an engineer on Binance’s Wallet DevOps team downloaded a tampered Homebrew installer while searching for a popular AI tool. Binance said it detected the incident and rotated related credentials, but information about the engineer’s role and colleagues on the wallet infrastructure team had been exposed.
In September, the attackers approached a second engineer through a job-hunting platform, posing as a project director. The engineer was invited to two interviews: one with a supposed HR representative and another with someone claiming to be the CEO of a company that Binance said did not exist. At the end of the second interview, the engineer was asked to download an assignment containing a malicious code repository onto a work computer.
The repository’s code ran during setup. Binance said the malware used obfuscation and evasion techniques, including replacing a legitimate development-tool component with a poisoned version to run commands and connect to an attacker-controlled server. The attackers also removed forensic evidence related to the compromise.
On October 20, the attackers used the compromised computer and abused an internal AI tool to gain control over the first engineer and another wallet software engineer. Binance said they found a container deployment permission token on the first engineer’s computer. On October 29, they logged into the third engineer’s computer with stolen credentials, deployed a container and ran a malicious script.
Binance said it has rebuilt the affected wallet system in a new environment and reconstructed its internal AI tool and access controls. The company also replaced affected devices, revoked related credentials and tokens, scanned employee devices, strengthened wallet-service risk controls and expanded AI-based behavioural anomaly detection. It said it is working with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.
Binance added that it has closed the identified entry points and rebuilt or replaced systems involved in the attack. The company also said it has foiled 57 suspected North Korea-linked cyber threat cases since the start of the year, and described fake job interviews, malicious developer tools and credential-stealing social engineering as techniques used in attacks targeting the cryptocurrency industry.
Sources: The Hacker News.