"It was not a single isolated breach or a simple phishing incident," Binance said, describing a "sophisticated, multi-stage campaign" that culminated in a record-setting theft of $6.43 billion from the exchange.
How the attack began: trojanized Homebrew and a June 2026 supply‑chain compromise
Binance traces the origin of the intrusion to June 2026, when a Wallet DevOps engineer identified in the company statement as "Engineer A" downloaded a trojanized Homebrew installer while searching for a popular artificial intelligence tool. That supply‑chain compromise delivered a backdoor: the installer was poisoned to deliver malicious code that the company says enabled the attacker to access Engineer A’s environment.
Binance said it detected the activity and, as a precaution, rotated related credentials at that time. However, the company added that information about "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker," creating further opportunities for follow‑on exploitation.
Fake recruitment interviews: the September 2026 social‑engineering vector
The campaign's second phase unfolded in September 2026. A threat actor posing as a Project Director used a legitimate job‑hunting platform to contact another employee, "Engineer B." The persona arranged a two‑round interview process that used human social cues to build trust: a first‑round video interview with an HR representative who shared a social media account and personal photos, followed by a second interview conducted on a popular social chat app with an individual claiming to be the CEO of a non‑existent company.
Near the end of that second interview, Binance said, Engineer B was instructed to download an "assignment" — a code repository containing malicious code — onto his work computer. The repository’s setup process executed the malware, which used advanced obfuscation, evasion techniques, and a poisoned development tool component to execute commands and call home to an attacker‑controlled server. The intruder also removed forensic artifacts to cover tracks, according to Binance.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEscalation: internal AI tool abuse and the October 29 container deployment
Binance describes a rapid escalation in late October. On October 20, 2026, the intruder leveraged Engineer B’s compromised machine and "abused an internal AI tool to gain control over Engineer A and another Wallet Software Engineer C." During that period the attacker discovered that Engineer A had a container deployment permission token on his computer.
On 29 October, between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, used credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script. The adversary then exploited unauthorized access to an internal wallet signing service to initiate transactions "outside the normal withdrawal process," leading to the $6.43 billion loss Binance reports.
Binance's remediation steps as of November 3
In the company’s account, immediate containment and remediation included rebuilding affected systems and enhancing controls. Binance said it reconstructed the affected wallet system in a new environment and rebuilt the internal AI tool and access controls. Specific steps listed by the company as of November 3 include:
- Replaced affected devices.
- Decommissioned credentials and tokens related to affected engineers.
- Completed enhanced security scans across all employee devices.
- Enhanced AI‑based behavioural anomaly detection.
- Strengthened wallet‑service risk controls.
- Worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets.
"The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced," Binance said. The company also said it is "increasing investment in AI‑enabled detection, endpoint protection, developer‑environment security and behavioural anomaly monitoring."
What this means for technologists, open‑source maintainers, and law enforcement
- Technologists and security teams: The incident highlights a chain that combined endpoint compromise, poisoned developer tooling, social engineering via recruitment channels, and abuse of internal automation and signing services — areas Binance said it has already addressed by replacing devices, decommissioning tokens, and enhancing AI‑based anomaly detection.
- Open‑source maintainers and package distributors: Binance’s account centers a trojanized Homebrew installer and a poisoned development component as initial vectors, underscoring the attack surface created when developer tools and packages are tampered with and then executed in privileged developer environments.
- Law enforcement and blockchain tracing partners: Binance said it has worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets. The company also reported foiling 57 suspected North Korea‑linked cyber threat cases since the start of the year, reflecting a sustained focus on tracing illicit transfers.
The public facts Binance released show a complex, multi‑stage intrusion that blended supply‑chain tampering, social engineering through fake recruitment, and the misuse of internal AI and deployment tooling to reach wallet signing infrastructure. Binance reports the technical entry points have been closed and affected systems rebuilt, and it is working with external partners to trace and freeze the assets. The record dollar figure — $6.43 billion — and the October 29 timeline remain the clearest anchors in a case that, by the company’s account, exploited both human trust and developer tooling at scale.
