Binance said unauthorized access to its internal wallet signing service led to transactions outside its normal withdrawal process and affected about $6.4 billion in digital assets, in what would rank among the largest reported cryptocurrency security incidents on record. The FBI attributed the attack to North Korea, according to Binance's Nov. 3 disclosure.
The company said the intrusion developed over several months, beginning with compromises of employee devices before reaching systems connected to wallet operations. Its account describes an attack chain built around a tampered software package, a fake recruitment process, malware on engineering machines, and later access to internal deployment permissions.
Binance said it will use its financial reserves to cover customer losses resulting from the incident. The company has also hired independent cybersecurity specialists to review the breach and said it plans to increase spending on endpoint defenses, developer-environment controls, AI security testing, and behavior-based monitoring.
Attackers reached the wallet signing service through employee devices
According to Binance's preliminary timeline, the campaign began in June 2026 when a wallet DevOps engineer downloaded a compromised Homebrew installer after using a web search engine to find an AI coding tool. Homebrew is a widely used package-management system for macOS that allows developers to install software and command-line tools.
Binance said its security team detected unusual activity on the engineer's device, replaced the computer, and rotated credentials linked to it. The attacker nonetheless gained information about the employee's responsibilities and connections within the wallet engineering team.
A second phase began in September, when an attacker contacted another engineer through a mainstream job platform. Binance said the attacker staged a recruiting process that opened with a video call presented as an HR interview, then moved the candidate to a chat application for a supposed technical assignment.
The engineer was instructed to download and run a code repository called 'Assignment' on a work computer. Binance said the repository contained obfuscated malware that it characterized as a zero-day, meaning malicious code exploiting a vulnerability or technique not previously detected by the target's defenses.
The malware reportedly altered components of pyenv, a tool developers use to manage Python versions. Binance said the code replaced a legitimate pyenv component, rebuilt command entry points through symbolic links, and launched commands through the zsh shell. That allowed the compromised machine to execute attacker instructions and communicate with attacker-controlled servers.
Internal AI tool was used to widen access
On Oct. 20, Binance said the attacker used the compromised device and an internal AI tool to take control of two additional computers, including the machine used by a third wallet engineer.
The company did not name the AI tool, identify the features involved, or say that the underlying AI model had a security flaw. Its description instead places the tool within the attacker's lateral-movement process after an employee device had already been compromised.
During that expansion, the attacker found a container-deployment permission token stored on one of the affected computers, Binance said. The token was not identified as a wallet private key, but gave the attacker a route toward internal deployment systems.
That distinction points to an operational risk beyond the theft of cryptographic keys. Security controls around wallet infrastructure can be undermined when an attacker gains access to the systems that deploy software, manage permissions, or initiate internal workflows.
On Oct. 29, between 17:15 and 19:56 UTC, Binance said the attacker accessed the third engineer's computer and used credentials obtained earlier in the campaign to deploy a container. A malicious script was then triggered to execute the final stage of the operation.
Binance said that stage gave the attacker unauthorized access to its internal wallet signing service, enabling transactions outside standard withdrawal workflows.
EIP-7702 feature was used against a hot wallet
The attacker also used Ethereum's EIP-7702 authorization mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet, Binance said.
EIP-7702 is an Ethereum account-abstraction feature designed to let externally owned accounts temporarily authorize code execution. In Binance's account, the mechanism became part of the final transaction path after the attacker had already reached internal signing infrastructure.
The reported $6.4 billion figure would exceed the $1.5 billion stolen from Bybit in 2025, a breach that had previously been described as the largest single cryptocurrency theft. Chainalysis reported that cryptocurrency-related thefts totaled $2.2 billion across 2024, putting the scale of Binance's reported incident above that earlier annual total.
Binance said it has identified and blocked 57 suspected North Korea-linked cyber threat attempts since the start of 2026. It listed fake job interviews, developer-tool malware, altered software packages, malicious browser extensions, fake meeting applications, and credential theft as recurring methods. The FBI has referred to related North Korean activity as TraderTraitor.
Review will focus on developer and deployment controls
The breach places particular scrutiny on the path from a developer workstation to production wallet systems. The reported sequence did not begin with a direct compromise of a hot wallet's private key. It moved through employee targeting, endpoint compromise, internal discovery, deployment permissions, and access to signing operations.
Binance said it is preparing a security research fund and working with AI companies, industry participants, and cybersecurity firms on security programs for blockchain environments. Its planned controls include stronger protections for developer machines and more monitoring for abnormal behavior inside internal systems.
For users, the incident reinforces the practical distinction between holding assets through a centralized custodian and controlling keys directly. Self-custody removes reliance on an exchange's internal wallet processes, though it transfers responsibility for backup, device security, and recovery procedures to the holder.
The immediate focus for Binance will be whether its review can identify every affected permission path and restore confidence in the separation between employee devices, deployment systems, and wallet-signing infrastructure.
Worried about hacks like this? Strengthen your defenses with our crypto safety standards guide before your next major transfer.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
