Cryptocurrency exchange Binance has confirmed what may be the largest single theft in the platform’s history: roughly $6.34 billion in digital assets siphoned out of its wallet systems on October 29, 2026. The FBI has attributed the intrusion to TraderTraitor, a North Korean hacking unit with a long track record of targeting cryptocurrency infrastructure, and Binance says the operation unfolded over several months rather than in a single smash-and-grab moment.

A Months-Long Setup

According to Binance’s own account of the incident, the attackers did not stumble into the exchange’s wallet systems by accident. The campaign reportedly began back in June 2026, when an engineer working on Binance’s wallet DevOps team searched for an AI-assisted coding tool online and ended up installing a tampered Homebrew package. That initial foothold was short-lived — Binance says it replaced the compromised device and rotated the engineer’s credentials soon after — but the damage went beyond that single machine. The attackers had already used the access to map out who inside the company worked on wallet infrastructure, intelligence that would prove valuable months later.

The second phase of the operation leaned on an entirely different playbook: social engineering through a fake hiring process. In September, another Binance engineer was contacted on a job platform by someone posing as a “Project Director.” Two scripted interviews followed, each designed to build trust, including one with a fabricated HR contact and another with an impersonated CEO. Near the end of the second conversation, the engineer was asked to download a take-home coding assignment onto his actual work laptop — a request that, once carried out, quietly handed the attackers a path into Binance’s internal network.

From One Laptop to the Wallet Signing Service

The planted code reportedly swapped out a legitimate configuration file during setup, created a new symlink, and launched a hidden shell session. Binance describes the payload as a zero-day capable of evading its endpoint security tools and erasing evidence of its own activity. From that single compromised laptop, the attackers pivoted again weeks later, in late October, using an internal AI assistant to manipulate two additional engineers — one of whom held a container deployment token that proved to be the final piece of the puzzle.

Using the stolen token, the attackers deployed a malicious container and executed a script that reached into Binance’s wallet signing service, bypassing the exchange’s normal withdrawal controls entirely. Within a few minutes on October 29, five hot wallets emptied out roughly 233 million XRP, with subsequent transfers pulling out close to a million SOL tokens, tens of millions of OP, and more than 18,000 BTC.

• Initial access: a trojanized Homebrew package used by a wallet DevOps engineer
• Escalation: a fake recruiting pipeline used to compromise a second engineer’s laptop
• Lateral movement: an internal AI tool manipulated to compromise two more engineers
• Final step: a stolen container deployment token used to reach wallet signing infrastructure

Abusing Ethereum’s Newer Account Features

What makes this heist particularly notable from a technical standpoint is how the attackers exploited Ethereum’s EIP-7702 feature, which allows a regular wallet address to temporarily delegate execution authority to a smart contract without exposing its private key. The attackers fired off roughly 50 signing transactions in quick succession to match the wallet’s constantly shifting transaction counter, or nonce. Eventually one landed, and the wallet effectively began executing the attacker’s code.

That delegation turned out to be unusually difficult to undo. Because Binance’s wallet relied on multi-party computation, no single key holder could simply revoke it, and the malicious delegation remained live on the blockchain even after withdrawals were frozen. Binance’s security team ultimately devised a workaround, authorizing a transaction to the Ethereum “zero address” at 00:10 UTC on October 30 to strip out the attacker’s code — though researchers note this neutralized the delegation without replacing the underlying signing key itself.

Recovery and Lessons for Defenders

Binance says it intercepted or froze close to $2.85 billion of the stolen funds and has committed to covering the rest of the shortfall from its SAFU insurance reserve and corporate funds, with the company reporting that 98% of affected customer balances had been made whole within two days. The FBI, meanwhile, says the stolen assets are being converted primarily into Ethereum, with further laundering expected to move through decentralized finance platforms and token swap services.

For security teams well beyond the crypto industry, the incident is a reminder that AI coding assistants and internal AI tooling are now viable attack surfaces in their own right, and that fake recruitment pipelines remain one of North Korea’s most reliable ways into a target’s internal network. Binance has since rebuilt its wallet infrastructure and internal AI tooling from scratch, reissued devices, revoked affected credentials, and rolled out AI-driven anomaly detection across employee endpoints. Security researchers are also urging organizations to treat “take-home assignments” delivered through recruiting platforms as a credible threat vector, keep sensitive deployment tokens off general-purpose laptops, and build incident response playbooks that separate access revocation from key rotation — since, as this case shows, stopping a transaction and undoing a malicious smart-contract delegation are not the same thing.