About $6.3 billion, mostly gone within about twenty minutes. And according to Binance’s own initial findings, it didn’t start with a genius hack of Binance’s servers. It started five months earlier, with one developer searching for an AI coding tool.
Watch the video
How the attackers got in, step by step, and what every developer should learn from it:
What happened on 29 October
At 20:05 UTC on 29 October 2026, Binance’s hot wallets (the online wallets an exchange uses to pay out withdrawals) started sending money to the attackers. Bitcoin, Ethereum, USDT, USDC, XRP, Solana: ten blockchains in total. Binance puts the damage at about $6.3 billion, and TRM Labs calls it the largest crypto hack in history.
But the money was the last step. The attack started in June, on a laptop.
Step 1, June: a fake AI coding tool
A wallet DevOps engineer (call them Engineer A) searched for a popular AI coding tool and ended up installing a tampered copy of Homebrew, the package manager most Mac developers use. One wrong download, and the attacker was on the machine. Binance replaced the laptop and rotated the credentials, but the attacker now knew who worked on the wallet team.
Step 2, September: the fake job interview
Engineer B got a message on a real job platform from someone posing as a project director, then had a video call with “HR” and a chat with the company’s “CEO”. None of them were real. Then came the test: download a coding assignment and set it up, on a work computer.
The moment it was set up, hidden code quietly replaced pyenv, a normal Python tool, with a malicious copy. Binance says its endpoint protection didn’t detect it, because it was brand-new malware.
Step 3, 20 October: an internal AI tool
From Engineer B’s laptop, the attacker used an internal AI tool to take control of two more machines, Engineer A’s and Engineer C’s. Binance hasn’t explained exactly how the AI tool allowed that. On Engineer A’s computer, the attacker found the jackpot: a token with permission to deploy containers.
Step 4, 29 October: the heist
Between 17:15 and 19:56 UTC, the attacker logged into Engineer C’s computer, used Engineer A’s token to deploy a container inside Binance, and started a script. Three engineers, three laptops and one forgotten token. That’s all it took.
The 3-minute sweep
On Ethereum, the attacker sent one transaction carrying 50 pre-signed permissions (EIP-7702 delegations) that pointed Binance’s hot wallet at the attacker’s own contract. Three minutes and 24 seconds later, the wallet was swept. Any new money that landed in it got swept again, until the last transfer at 23:56, almost four hours later.
How Binance responded
- Withdrawals and trading were paused. Tether, Circle, Ripple and others froze stolen stablecoins, about $2.85 billion according to Binance.
- At 00:10 UTC on 30 October, Binance cleared the malicious delegation from its wallet, and says no wallet private key was leaked.
- Binance says customers won’t pay for this: it’s covering the loss from its own funds, says 98% of affected assets were replenished by 31 October, and withdrawals restarted on 1 November.
Who did it?
On 31 October, the FBI attributed the attack to North Korea, a group known as TraderTraitor, and Chainalysis reached the same conclusion from on-chain evidence. North Korea denies it. Binance says it blocked 57 other attempts this year that were linked to North Korea, using fake interviews, fake developer tools, poisoned packages and browser extensions. This one got through.
5 lessons for every developer
- Install developer tools only from the official website. Don’t trust the first search result, and never a sponsored one.
- Never run a job-interview assignment on your work computer. Use a throwaway virtual machine, exactly like we do on our channel.
- No long-lived deploy tokens on laptops. Make them short-lived, limited, and protected with a hardware key.
- Treat internal AI tools like admin tools: if they can reach other machines, they need the same access controls and logging.
- Attackers move in minutes. If your alerts take an hour, they’re too slow.
This article is based on Binance’s initial findings and public reporting. The investigation is ongoing and details may change. It’s a security explainer, not financial or investment advice.
Sources: Binance initial findings (X) · SafeDep · Unite.AI · TRM Labs · Chainalysis
More on YouTube
Prefer watching? The full Binance hack walkthrough is on our YouTube channel: watch the video. For more hands-on breakdowns of security bugs, Linux servers and dev tools, subscribe at youtube.com/@fineshotai.