the binance theft, layer by layer

On 29 October 2026 an attacker moved billions out of Binance’s hot wallets in a single evening. On 3 November Binance published its initial findings, and they describe something slower than a heist. The preparation started in June, went through a fake job interview in September and two more engineers’ computers in October, and ended in a container the attacker deployed with a stolen token.

This page reads that record in layers. The first two take a few minutes and are for anyone who signs off on risk. The middle is the chain itself and the eight places it could have stopped. The end is an exercise to run with your own team, and the evidence for every number used here. The laptop at the centre has its own guide, the laptop that can reach production, and this page does not repeat it.

the short version

Binance says it found no evidence that a private key leaked. The attacker reached the service that signs withdrawals and asked it to sign. Everything before that was a series of ordinary steps: an engineer installing a tool, another doing a job interview, an internal tool that could reach colleagues’ machines, a deployment token on a laptop. The FBI attributes the theft to TraderTraitor, a North Korean state group. North Korea’s state media called the claim a grave political provocation, according to CNBC.

Every step was something your own staff did last week.

for the people who sign off

Three things failed at Binance, and none of them is about cryptocurrency.

A cleaned-up incident still taught the attacker something. In June, Binance says, its security team caught a tampered installer on a wallet engineer’s laptop, replaced the device and rotated the credentials. The episode had already shown the attacker who that engineer was and who worked with them. The next approach, in September, went to a colleague.

Personal life and company equipment met on one laptop. The September target took a job interview elsewhere and ran the interview task on a work computer, according to Binance’s findings. That is a normal human thing to do, and it handed the attacker a machine inside the company.

The systems that move money trusted whatever reached them from inside. Once a container was running with a valid deployment token, the signing service treated its requests as legitimate. TRM Labs’ timeline shows the Ethereum hot wallet sending its entire balance in one transaction.

Five questions to ask your IT lead or provider this month:

1. When we close an incident, do we also ask what the attacker learned about our people?
2. What is our rule for job tasks, test projects and tools downloaded from the internet on company laptops?
3. Which internal tools can run commands on, or reach into, other employees’ computers?
4. Where do the tokens that can deploy to production or move money live, and could one sit on a laptop?
5. If one request asked our payment system for everything at once, what would stop it?

how it happened

the chain, as Binance described it on 3 November 2026

1. 1June: the first lureA wallet DevOps engineer searching for an AI coding tool downloads a tampered Homebrew installer. Caught, device replaced, credentials rotated.
2. 2September: the interviewA software engineer is approached on a real job platform, talks to a fake HR person and a fake CEO, and runs the interview task on a work laptop.
3. 320 October: sidewaysFrom that laptop, through an internal AI tool, the attacker takes over two more engineers' computers and finds a container deployment token.
4. 429 October, 17:15 to 19:56 UTCThe attacker signs in on one of the taken-over computers, deploys a container with the stolen token and starts the script.
5. 520:05 UTC onwardThe wallet signing service signs transfers outside the normal withdrawal process, across Binance's hot wallets.
6. 600:10 UTC, 30 OctoberBinance clears the last delegation the attacker had set up on Ethereum.

The interview task changed one file. According to Bitcoin Magazine’s account of Binance’s findings, the task replaced a legitimate part of pyenv, a common tool for managing Python versions, with a malicious one that opened a channel to the attacker’s server. The device’s security tools did not flag it. SafeDep, a software supply chain security company, points out that on a Mac the Homebrew folder belongs to the logged-in user, so anything running as that user can swap a tool without a password.

The internal AI tool is the least explained step. Binance says the attacker used it from the compromised laptop to take control of two colleagues’ computers on 20 October. It has not said what the tool does or why it could reach other machines. Binance says it has rebuilt the tool in a new environment.

The signature was real. Binance says it found no evidence that any private key leaked. The attacker’s container could ask the signing service for transfers, and the service signed them. On Ethereum, according to Binance’s findings, it also signed 50 transactions that delegated part of a hot wallet’s control to the attacker’s contract, using a feature called EIP-7702. Those delegations kept working after withdrawals were suspended.

Stopping it took hours. Binance’s wallets use multi-party computation, which spreads the signing key across several parties so no single copy exists. That also meant there was no single key to revoke when the delegations had to go, and the team worked out the procedure during the incident. The last unauthorised transfer, 2,961.9 ETH, went out at 23:56 UTC, according to Bitcoin Magazine’s account.

eight places it could have stopped

doors the chain went through

• the June clean-upDevice and passwords changed, exposure of names and roles left open
• the interview taskA stranger's code ran on a work laptop
• the user-owned tool folderA developer tool could be swapped without a password
• the endpoint toolsThe swapped file did not raise an alert
• the internal AI toolIt could reach colleagues' computers
• the token on a laptopDeploying to wallet infrastructure needed only a token someone held
• the signing serviceIt signed for a container that had just appeared
• the revoke procedureWritten during the incident, while delegations stayed live

open on 29 October, per Binance's findings

The same eight doors exist at a company that has never held a coin. Read each one with your own payment run, deploy pipeline or main admin console in mind.

Close the clean-up properly. When a laptop is caught with malware, the attacker may already know who its owner works with. Tell that team. They are the next likely targets, and a warning costs one message.

Give outside code its own machine. Job tasks, test projects and tools from the internet run in a throwaway virtual machine or cloud sandbox. The laptop guide has the reasoning, and the 2022 joint advisory from the FBI, CISA and the US Treasury on TraderTraitor describes fake recruitment aimed at DevOps and developers.

Treat a tool that reaches other computers as an admin account. Remote support tools, device management, automation agents and internal AI assistants that can run commands are as powerful as the access they hold. The agent guide covers how such tools inherit identity.

Keep the deploy and payment tokens off laptops. A token that can change production or move money belongs in the pipeline or a vault, issued for minutes when needed. The service accounts guide explains why these identities outlive everyone’s attention.

Make the money system check where a request comes from. A new container, a new server or a new script asking for a payment for the first time is worth a hold and a human look.

Cap what one request can do. Daily limits and amount thresholds turn a total loss into a partial one. The blast radius guide shows how to find the systems where a cap matters most.

Practise the revoke before you need it. For every kind of access you can grant, someone should know how to take it back, and should have done it once on a test account. The token guide shows how often taking it back is harder than it looks.

the same chain at a company without a wallet

Picture a 200-person company that pays suppliers every Thursday. A finance script prepares the batch, and the bank portal releases it with a token the script holds. Two engineers maintain the script. One of them is quietly looking for a new job.

A recruiter on a well-known job site invites that engineer to a second interview and sends a small coding task. It runs on the work laptop because that is where the development setup is. Three weeks later someone else’s code is running a new copy of the finance script with the real token, and the bank sees a normal Thursday batch, sent on a Tuesday night.

Nothing in that picture needs a nation-state. It needs one door from each of the eight above.

run it as an exercise

The chain works as a tabletop exercise for an hour with IT, finance and whoever owns HR. Read each stage aloud, then answer its questions before moving on.

1. June. Endpoint protection flags malware on a developer’s laptop. You replace the device. Who else do you tell, and what would the attacker have seen on that laptop?
2. September. An employee mentions they did an interview task for another company on their work laptop last month. What happens next, and who decides?
3. 20 October. An internal tool shows activity on two engineers’ machines that neither of them started. Who sees that alert, and how fast?
4. 29 October, 17:15. A container nobody deployed is running in the payment environment. How would anyone know before it sends its first request?
5. 29 October, 20:05. Money is leaving and you have suspended the payment run, but a permission granted earlier is still being used. Who knows how to revoke it, and has anyone done it before?

Write down every answer that starts with “probably” or “I think”. Those are the doors still open at your company.

what is still unknown

Binance’s findings are initial, and it says a full report will follow. Several things it has not explained matter for anyone drawing lessons:

• What the internal AI tool is and how it took over other computers.
• Why the deployment token sat where the attacker could find it, and whether it belonged to the engineer caught in June.
• Why the signing service accepted requests from a newly deployed container.
• Why hot wallet limits allowed whole balances to leave.
• The final loss after freezes and recoveries.

the numbers and where they disagree

The record has several totals, because each source values the assets at a different moment or counts a different scope:

• about $6.3 billion is Binance’s own figure, and $6.34 billion appears in its 3 November findings as reported by The Block.
• $6.36 billion is TRM Labs’ value at the moment of theft, across ten blockchains, most of it in about 20 minutes.
• $6.43 billion is Elliptic’s figure, across 11 blockchains.
• more than $6 billion is the FBI’s wording in its alert of 31 October 2026.

On laundering, Elliptic counted about 12,000 wallets and more than 40,000 transactions in the first three and a half days, with $2.85 billion frozen or seized and about $3.18 billion still in linked addresses as of 3 November. Those two figures do not add up to Elliptic’s total, and its post does not explain the gap.

The attribution is the FBI’s. Its alert names TraderTraitor and lists the addresses it says hold or held stolen funds. North Korea’s state media rejected the claim, CNBC reported on 3 November 2026.

the question to take to your team

If someone ran a stranger’s code on one of your engineers’ laptops tonight, how many of the eight doors would they find open before they reached the money?