Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops

On October 29, 2026, attackers took about USD 6.34 billion from Binance hot wallets. The attack started on developer laptops, through a tampered Homebrew install and a fake job interview. The Federal Bureau of Investigation (FBI) attributes it to North Korea (DPRK). Binance published its initial report⁠(opens in new tab) on November 3, and all facts in this post come from it.

TL;DR

• About USD 6.34 billion left Binance hot wallets. Partners froze or intercepted about USD 2.85 billion. Binance covers the loss for users.
• In June, a wallet DevOps engineer installed a tampered Homebrew package. The attacker learned who works on the wallet team.
• In September, a fake recruiter gave a second engineer a take-home assignment. The repository ran malware during setup on a work laptop.
• In October, the attacker used an internal AI tool to reach two wallet engineers, took a container deployment token, and signed transactions through the wallet signing service.
• Binance stopped 57 other suspected North Korea-linked attempts in 2026. They used fake interviews, fake developer tools, compromised packages and browser extensions.

The attack path

June 2026            Engineer A (Wallet DevOps)
                     searches for an AI coding tool
                     installs a tampered Homebrew package
                     -> device replaced, credentials rotated
                     -> attacker now knows the wallet team

September 2026       Engineer B (Software Engineer)
                     fake recruiter on a job platform
                     interview 1: video call with "HR"
                     interview 2: chat app with "CEO"
                     runs the "assignment" repository on a work laptop
                     -> setup step runs malware, pyenv is replaced

October 20           attacker uses an internal AI tool from Engineer B's laptop
                     -> gains control over Engineer A and Engineer C
                     -> finds a container deployment token on Engineer A's machine

October 29           17:15-19:56 UTC  logs on to Engineer C's computer
                                      deploys a container with Engineer A's token
                                      runs the attack script
                     20:05 UTC        first unauthorized hot wallet transfers
                     23:56 UTC        last unauthorized transfer (2,961.9 ETH)

October 30           00:10 UTC  EIP-7702 delegation cleared

The tampered Homebrew install

Engineer A searched for a popular AI coding tool and installed it through a tampered Homebrew installation. Binance links to a SANS Internet Storm Center diary⁠(opens in new tab) for details. Binance’s security team replaced the device and rotated credentials. By then the attacker knew Engineer A’s role and the other engineers on the wallet infrastructure team.

The fake job interview

Engineer B listed Binance experience on a job platform. A person posing as a Project Director set up two interviews. In the first, an “HR representative” on a video call shared a personal social media account to build trust. The second took place in a chat app with the “CEO” of a company that does not exist. The interviewer then asked Engineer B to download an assignment repository to the work computer. The repository ran malicious code during setup.

The malware replaced pyenv with a malicious copy. Binance published these file operations:

The malicious pyenv ran commands and connected to an attacker server. Endpoint security tools did not detect it. The logged-in user owns /opt/homebrew, so malware that runs as that user can replace any tool there without a password prompt.

Contagious Interview

Binance does not name a campaign. In SafeDep’s assessment, the interview matches Contagious Interview, a North Korea-linked campaign that targets developers with fake recruiters and code that runs on install, build or start. SafeDep has documented the same method before:

• antd-img-crop OverLord stealer. A forged commit runs a stealer on npm run build. The same payload also came through a fake careers portal.
• PolinRider with Ethereum C2. 35 GitHub repositories carry a loader that runs when a developer builds or starts the project.
• Astro configuration file with blockchain C2. A pull request that hides the loader in a build configuration file.

From one laptop to the wallets

Engineer B laptop (malware)
   │
   ▼
internal AI tool  ──►  Engineer A laptop  ──►  container deployment token
                  ──►  Engineer C laptop               │
                            │                          │
                            ▼                          ▼
                     attacker logs on, deploys a container
                                   │
                                   ▼
                     internal wallet signing service
                                   │
                                   ▼
               hot wallet transfers + EIP-7702 delegation

Binance does not say how the internal AI tool gave control over other engineers’ computers. The attacker used the wallet signing service to send transactions outside the normal withdrawal process. It also signed 50 transactions to set up an EIP-7702 (Ethereum Improvement Proposal 7702) delegation. That delegation gave an attacker contract partial control of a hot wallet, and it stayed active on-chain after Binance stopped withdrawals. The hot wallet uses Multi-Party Computation (MPC), so Binance had no single private key to sign a fast revocation.

Sources

• Binance, Initial Findings and Response Update⁠(opens in new tab) on X, published November 3, 2026
• FBI, North Korea responsible for $6 billion Binance attack⁠(opens in new tab)
• SafeDep, October 2026 Security Incident Review