Binance says its security team caught that June compromise at the time, replaced the engineer's device and rotated his credentials, and the attacker still reached the internal wallet signing service four months later. About $2.85 billion of the stolen assets have been frozen or intercepted.
Binance said the theft that took about $6.34 billion out of its hot wallets on October 29 began four months earlier, when an engineer on its wallet DevOps team searched for a popular AI coding tool and installed it through a tampered Homebrew installer. The exchange published a preliminary account of the intrusion on November 3, and the reconstruction reported by The Hacker News traces a campaign that moved from that one laptop in June to the internal service that signs the exchange's wallet transactions.
The June compromise did not go unnoticed. Binance's security team spotted the anomaly, replaced the engineer's device and rotated his credentials. By then, according to the account, the attacker had already learned what that engineer did and who else worked on wallet infrastructure, and that proved enough to carry on.
In September the attacker approached a second engineer whose profile on a job-hunting platform mentioned his Binance experience. Someone posing as a project director made contact, a purported human resources representative ran a first-round video interview and pointed to a social media account with personal material to establish credibility, and a second round took place on a chat application with a person claiming to be the chief executive of a company that did not exist. Near the end of the process the engineer was asked to install an assignment repository on his work computer.
The code in that repository ran during setup. It was obfuscated, it swapped a legitimate development tool for a poisoned copy, it contacted a server the attacker controlled, and it deleted traces of itself. SafeDep, which analyzed the published account, identifies the replaced tool as pyenv. Binance's endpoint security did not flag any of it at the time.
By October 20 the attacker was using that machine, together with one of Binance's internal AI tools, to take control of the first engineer's account and that of a third engineer working on wallet software. On the first engineer's machine the attacker found a token granting permission to deploy containers. SafeDep notes that the published account does not explain how the internal AI tool produced access to those other two machines.
The theft itself ran on a short clock. Between 17:15 and 19:56 UTC on October 29 the attacker logged into the third engineer's computer, used the first engineer's stolen credentials to deploy a container and triggered a malicious script, which opened a path to an internal wallet signing service able to send transactions without passing through the normal withdrawal process. Unauthorized transfers began at 20:05 UTC, and the last of them, 2,961.9 ether, was confirmed at 23:56 UTC.
The mechanism at the end of that chain was already known. Binance said last week that the attackers had reached a hot wallet through Ethereum's account-delegation feature, as MiningPool reported when the exchange found more breach points and set aside $6.34 billion. The November 3 account puts a number on it: 50 signing transactions created an EIP-7702 delegation that handed a contract the attacker controlled partial control of a hot wallet, and the delegation stayed live after Binance suspended withdrawals. Binance cleared it at 00:10 UTC on October 30.
About $2.85 billion of the stolen assets have been frozen or intercepted, Binance says, with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed, although seven networks still had no restoration date when the exchange reopened 51 more tokens on November 3.
The FBI and other United States agencies have attributed the theft to TraderTraitor, a North Korean state-sponsored group. Binance says it detected and stopped 57 suspected North Korea-linked threats during 2026.
The exchange says it has replaced the affected devices, decommissioned the engineers' credentials and tokens, scanned every employee device, rebuilt the wallet system in a new environment and rebuilt the internal AI tool along with its access controls, and added behavioral anomaly detection to the wallet service. Outside security firms have been brought in and the investigation is continuing.
Every step the account describes happened on a developer's machine or inside an internal tool rather than in the cryptography protecting the wallets. Ledger confirmed an unauthorized hardware implant inside a CryptoBilis device in October, the hardware version of the same exposure. Binance detected the June compromise at the time and still lost about $6.34 billion four months later.
