Binance Details Multi-Stage North Korean Operation Behind $6.34 Billion Crypto Heist

Binance has disclosed new details about the $6.34 billion cryptocurrency theft that struck the exchange on October 29, 2026, revealing that attackers used a combination of fake recruitment schemes, malicious developer tools, and an internal AI platform to gradually gain access to critical wallet infrastructure. According to Binance's investigation, the operation unfolded over several months and ultimately led to one of the largest cryptocurrency thefts in industry history. The FBI has attributed the attack to North Korean threat actors, while Binance has pledged to cover all losses using company funds and maintain full protection for customer assets.

Binance's investigation found that the campaign began months before the theft occurred. In June 2026, a wallet DevOps engineer unknowingly installed a trojanized version of Homebrew while searching for an AI-powered coding application. Although Binance detected suspicious activity, replaced the affected system, and rotated credentials, attackers reportedly gathered intelligence about the engineer's responsibilities and relationships within the company's wallet operations team. Those insights later helped the threat actors identify additional targets inside the organization.

The operation expanded in September when another wallet engineer was contacted through a job-search platform by an individual posing as a recruiter. During what appeared to be a legitimate interview process, the engineer was instructed to download a coding assignment repository onto a company-issued workstation. Binance stated that the repository contained malware specifically designed to compromise the developer environment. Investigators determined that the malicious software replaced a legitimate pyenv component with a backdoored version capable of executing attacker-controlled commands and communicating with remote infrastructure operated by the threat actors.

On October 20, the attackers leveraged the compromised workstation and reportedly abused an internal AI tool to move laterally within Binance's environment. The intrusion ultimately provided access to the devices of two additional wallet engineers. One compromised system contained a container deployment token used within Binance's infrastructure. While the company confirmed the AI platform played a role in the attack chain, it has not publicly disclosed the specific mechanism that enabled the attackers to use the tool to gain broader access to internal systems.

The final phase of the attack took place on October 29 when threat actors used credentials stolen from one engineer and access to another engineer's computer to deploy a malicious container and launch unauthorized scripts. Within minutes, multiple Binance hot wallets began transmitting large amounts of cryptocurrency to attacker-controlled addresses. The unauthorized transfers included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP tokens, and 18,270 BTC, making the incident one of the most significant digital asset thefts ever recorded.

Investigators also discovered that the attackers exploited Ethereum's EIP-7702 account authorization feature, which allows wallet owners to delegate specific execution permissions to smart contracts. Rather than stealing a private key, the attackers used the mechanism to grant a malicious smart contract limited authority over a Binance hot wallet. This approach enabled unauthorized transactions while avoiding direct exposure of the wallet's private credentials, creating additional challenges for incident responders attempting to contain the attack.

Binance explained that suspending withdrawals did not immediately halt the movement of funds because the malicious authorizations had already been established on-chain. The exchange's multi-party computation (MPC) wallet architecture further complicated response efforts because there was no single private key that could instantly revoke the malicious delegations. According to Binance, these technical limitations increased the time required to fully contain the unauthorized activity and prevent additional asset transfers.

The last unauthorized transaction involved 2,961.9 ETH and settled shortly before midnight UTC despite having been broadcast earlier and remaining pending for several hours. Binance reported that the malicious authorization mechanism was fully neutralized shortly after midnight on October 30. The company subsequently launched extensive remediation efforts aimed at restoring affected systems and strengthening security controls across its infrastructure.

As of November 3, Binance reported that approximately $2.85 billion worth of stolen assets had been frozen or intercepted, although the final figure remains subject to reconciliation and cryptocurrency market fluctuations. The company also stated that 98 percent of affected token balances had been replenished by October 31. Binance clarified that these replacement assets were supplied by the company itself and do not represent recovered stolen funds.

In response to the breach, Binance rebuilt impacted systems, replaced compromised devices, strengthened access management controls, and launched an ongoing forensic investigation. The company also announced that independent cybersecurity firms would review its findings and security response procedures as part of a broader effort to improve defenses against advanced state-sponsored threats.

The attack follows a growing pattern of large-scale cryptocurrency thefts linked to North Korean cyber operations. In February 2025, attackers stole approximately $1.5 billion from cryptocurrency exchange Bybit in a separate incident that was also attributed by the FBI to North Korean actors and later linked by investigators to the Lazarus Group. Security experts reviewing Binance's findings have questioned how an initial compromise involving a developer workstation was ultimately able to reach highly sensitive wallet infrastructure responsible for safeguarding billions of dollars in digital assets. The incident underscores the increasing sophistication of modern social-engineering campaigns that combine recruitment scams, supply-chain compromises, credential theft, and advanced lateral movement techniques to target cryptocurrency organizations.