Binance has disclosed that hackers stole approximately $6.34 billion in cryptocurrency after compromising employee devices, exploiting internal AI tooling, and gaining unauthorized access to its wallet-signing infrastructure. The October 29, 2026, attack involved multiple blockchain networks, including Bitcoin, Ethereum, Solana, and XRP. The FBI has attributed the operation to North Korean hackers associated with the TraderTraitor campaign.
FAKE JOB INTERVIEWS AND AI TOOLS ENABLED THE ATTACK
Attackers targeted Binance engineers through fraudulent recruitment interviews, convincing an employee to download a malicious programming assignment onto a corporate computer. The malware established unauthorized access and helped attackers steal credentials. Investigators also identified an earlier compromised software package and the abuse of an internal AI tool that reportedly helped attackers expand their access to additional employees and deployment infrastructure.
HACKERS EXPLOITED WALLET-SIGNING SYSTEMS TO STEAL BILLIONS
On October 29, attackers deployed a malicious container and gained access to Binance’s internal wallet-signing service, allowing unauthorized cryptocurrency transfers. The hackers also exploited Ethereum’s EIP-7702 authorization mechanism to establish malicious smart-contract permissions that remained active even after Binance suspended withdrawals. The exchange’s multiparty computation wallet architecture complicated containment because security teams needed specialized procedures to revoke the unauthorized permissions.
BINANCE PROMISES CUSTOMER PROTECTION AS FBI INVESTIGATES
Binance stated that customers would not bear the financial losses and reported that approximately $2.85 billion in stolen assets had been frozen or intercepted by November 3. The exchange also replaced compromised devices, revoked credentials, and strengthened its wallet and AI security controls. The FBI identified North Korea’s TraderTraitor operation as responsible and warned cryptocurrency platforms to monitor suspicious transactions. The incident highlights the growing risks associated with compromised developer environments, AI infrastructure, and cryptocurrency-signing systems.