On October 29, 2026, $6.34 billion in digital assets were stolen from Binance in one of the largest crypto heists to date. Authorities attribute the attack to a North Korean group known as “TraderTraitor.” It wasn’t a rudimentary phishing scam — this was a carefully orchestrated multi-stage operation targeting engineers at the world’s largest crypto exchange. Key tools included fake job interviews, poisoned AI software, and hijacked internal systems. The FBI reported the total stolen assets to be over $6 billion. Binance places the value at about $6.34 billion.
Engineering Infiltration: How It Began
The attackers focused on personnel in Binance’s wallet infrastructure division. In June 2026, one DevOps engineer unknowingly downloaded a compromised Homebrew package after searching online for an AI coding utility. This software was tampered with, allowing attackers to understand who managed wallet systems. Despite device replacement and credential rotation, the damage was already set in motion.
Months later, in September, another engineer was targeted via a job-listing platform. Fake recruiters—posing as a project director, HR, and even a CEO—convinced the engineer to participate in interviews. Personal social media references were used to boost credibility. Eventually, the engineer was given an “assignment” that involved running code on their work computer. This proved to be a pivotal breach.
Malware, AI Tools, and Complete Takeover
Once the compromised code ran during the assignment, it replaced a legitimate pyenv file with a malicious version, created a new symbolic link, and launched a zsh shell. The malware disabled its own traces and evaded endpoint defenses. By October 20, attackers had used the compromised engineer’s machine and Binance’s internal AI tool to hijack credentials belonging to two other engineers—one of whom had a container deployment token.
On October 29, between 17:15 and 19:56 UTC, the attackers logged into a third targeted engineer’s computer. With the stolen deployment token, they launched a malicious container and deployed a script to take control of Binance’s wallet signing service — bypassing normal withdrawal systems. Over the next few hours, funds began flowing out: 233.46 million XRP, thousands of SOL, millions of OP, and thousands of BTC.
An additional layer of the attack involved misusing Ethereum’s EIP-7702 feature, which allows an account to delegate execution rights to a smart contract without revealing its private key. The adversaries set up multiple signing transactions to match nonce changes. One match succeeded, giving them control via smart contract code. Because this delegation was on-chain and persistent, simply stopping withdrawals didn’t end the threat. Since Binance’s wallet infrastructure uses Multi-Party Computation (MPC), revoking a single key wasn’t enough.
Responding to the breach, Binance cleared the delegation by authorizing the zero address at 00:10 UTC on October 30, which removed the attacker’s code though not the stolen signing key. Approximately $2.85 billion of the stolen funds have since been frozen or intercepted. By October 31, 98% of impacted tokens were replaced, with nearly all losses covered through its SAFU insurance fund and corporate reserves.
Aftermath & Defense Measures
Binance has rebuilt its wallet systems and internal AI tool infrastructure, replaced hardware, and revoked compromised credentials. A full device-audit was conducted, AI-based anomaly detectors were put in place, and an independent security review is ongoing.
The lessons are stark: job offers requiring code execution on work machines are red flags. Using isolated devices for interviews, restricting AI tool permissions, and keeping deployment tokens off general access machines are all critical. Keeping logs of permission changes (not just transfers), rotating keys separately from revoking access, and providing comprehensive threat context to security operations teams are essential tactical changes.
This attack builds on a pattern previously observed: cultivated fake interviews and tainted DevOps assignments, amplified by AI tools and controlled environments.
The TraderTraitor breach highlights how social engineering, AI abuse, and identity masquerading are now central to modern crypto crimes. Organizations in the crypto sector—and beyond—must rethink endpoint security, credential hygiene, and internal privilege design. What you do today in your policies and tooling can mean the difference between containment and catastrophe. What to watch: how regulators force disclosure, how smart-contract tools adapt to new delegations, and whether AI governance frameworks tighten around internal platforms.
