Updated 2026-11-15
Short answer: on 29 October 2026 an attacker used Binance's internal wallet signing service to move about $6.34 billion out of its hot wallets (Binance). The way in was a work computer: an engineer ran a fake job interview "assignment" in September, and the attacker moved from there to the wallet team. The FBI says North Korea is responsible. Binance says it covered the losses from its own funds and, as of 14 November, is still reopening withdrawals network by network.
| When | What happened |
|---|---|
| June 2026 | Wallet DevOps engineer A installs a tampered Homebrew while searching for an AI coding tool. Binance replaces the device and rotates credentials, but A's role and team are now known to the attacker (Binance). |
| September | Engineer B is contacted on a real job platform, interviewed on video by a fake HR person and in a chat app by a fake CEO, and told to download an assignment repository to his work computer. Its setup swaps a development tool for a malicious copy. Endpoint protection does not catch it (Binance). |
| 20 October | From B's computer the attacker uses an internal AI tool to take over the computers of A and a third engineer, C, and finds a container deployment token on A's (Binance). |
| 29 October, 17:15 to 19:56 UTC | On C's computer, with A's credentials, the attacker deploys a container and starts a malicious script (Binance). |
| 29 October, from 20:05 UTC | Hot wallets send 233.46 million XRP, about 970,500 SOL, 44.2 million OP and 18,270 BTC to the attacker. On Ethereum, 50 signing transactions set up EIP-7702 delegations that keep working after withdrawals are paused. The last transfer, 2,961.9 ETH, lands at 23:56 UTC (Binance). |
| 30 October | Binance clears the delegation at 00:10 UTC, then announces about $6.3 billion lost and about $3 billion frozen. Chainalysis attributes the theft to the North Korean group TraderTraitor. |
| 31 October | The FBI says North Korea was responsible for "the theft of more than $6 billion" and calls the activity TraderTraitor. |
| 1 November | Withdrawals resume in phases (Binance). |
| 3 November | Binance's initial findings: about $6.34 billion impacted, about $2.85 billion frozen or intercepted, 98% of impacted tokens replenished as of 31 October. |
| 13 November | Binance says it has completed coverage of the impacted assets and published a new Proof of Reserves snapshot covering 198 tokens. |
| 14 November | Withdrawals reopened for 87 more networks that week; Binance aims to reopen the rest by the end of the following week. |
The figures differ by source: about $6.34 billion impacted (Binance, 3 November), about $6.4 billion (Chainalysis), more than $6 billion (FBI). Chainalysis bases its attribution on stolen Binance funds mixing on-chain with funds from the Bitget theft a month earlier, which was attributed to North Korea. Binance says "the latest information released by the Federal Bureau of Investigation indicates" that North Korea is responsible. Binance has not named the internal AI tool or explained how it was used to reach other machines (StepSecurity).
Binance has published statements on at least two thefts from its own hot wallets. On 7 May 2019 attackers who had collected user API keys and 2FA codes withdrew 7,000 BTC in one transaction from its BTC hot wallet, which held about 2% of its BTC, and Binance covered it from its SAFU fund (Binance). The second is October 2026. Binance also says its security team detected and stopped 57 suspected North Korea-linked attack attempts during 2026.
Binance's report names no software vulnerability as the way in (StepSecurity). The attack needed a developer to run setup code, and a machine that held a token able to deploy to production. StepSecurity recommends mapping "which local credentials can create containers, modify deployment configuration, or reach signing services". On your own machine that starts with seeing what is there:
ls -la ~/.kube/config ~/.docker/config.json ~/.aws/credentials ~/.config/gcloud 2>/dev/null kubectl config get-contexts 2>/dev/null gh auth status
These list credential files, Kubernetes contexts and the GitHub account and token scopes the CLI uses. They change nothing. Before running a take-home assignment or any unfamiliar repository, read the parts that run on setup: how to check a GitHub repo before you run it. To check a Mac for the swapped pyenv and the fake Homebrew installers, see fake Homebrew installers and trojanized pyenv.
FixLane pages: Binance CEX hacked, malicious coding assignment that reached wallet signing, trojanized pyenv in the Binance intrusion.
Binance put the impact at about $6.34 billion in its 3 November 2026 findings, with about $2.85 billion frozen or intercepted. Chainalysis says about $6.4 billion, the FBI more than $6 billion.
Binance says an engineer ran a fake job interview assignment on his work computer in September 2026. Its setup replaced a development tool with a malicious copy. The attacker then used an internal AI tool to reach two wallet engineers and a container deployment token.
The FBI says North Korea, and calls the activity TraderTraitor. Chainalysis attributes it to the same group.
Binance has published statements on at least two hot-wallet thefts: 7,000 BTC on 7 May 2019 and about $6.34 billion on 29 October 2026.
Connect an AI agent to the free, read-only FixLane MCP server or ask the Telegram bot: it checks what you have installed against verified fixed versions and serves a reviewed fix procedure. All guides.