NewsPublished 4 Nov 2026

Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist

Source SecurityWeek

Description

A sophisticated months-long cyberattack compromised three Binance engineers' computers, enabling hackers to steal $6.34 billion from the exchange's hot wallets. The attack involved social engineering via fake job interviews, malicious code hidden in a coding assignment, and abuse of an internal AI tool. Attackers exploited unauthorized access to wallet signing services and Ethereum's EIP-7702 mechanism to move assets. Binance has frozen or intercepted roughly $2.85 billion of the stolen funds and rebuilt affected systems. The FBI attributes the attack to the North Korean state-sponsored group TraderTraitor.

Impact

The attackers successfully stole $6.34 billion in cryptocurrency assets from Binance's hot wallets, exploiting internal systems and multi-party computation protections. Approximately $2.85 billion of the stolen assets have been frozen or intercepted. The breach caused significant disruption and loss of user funds, undermining trust in Binance's security. The attackers maintained unauthorized on-chain contract authorizations that operated independently of Binance's withdrawal infrastructure, complicating mitigation efforts. The incident also exposed vulnerabilities in employee security awareness and internal AI tool usage.

Defensive guidance

Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, and retired the credentials and tokens of the affected engineers. The exchange is working with independent security firms to review the incident and has implemented a research fund focused on AI security in blockchain environments. Users should note that withdrawals have broadly resumed, and 98% of impacted tokens have been replenished. No further immediate action is required from users as Binance has taken comprehensive remediation steps.

Summary

Binance's incident report details a complex intrusion campaign starting in June 2026, involving fake recruiters, malicious downloads, and hijacked employee computers. A Wallet DevOps engineer initially downloaded a tampered Homebrew installation containing malware. Subsequently, another engineer was targeted through staged interviews that led to installing a malicious coding assignment on his work device. This malware replaced a legitimate developer tool component and established a covert channel to attacker servers. Attackers leveraged an internal AI tool to gain control over multiple engineers' systems. Using stolen credentials and tokens, they accessed internal wallet signing services and exploited Ethereum's EIP-7702 to authorize unauthorized asset transfers from hot wallets secured by multi-party computation. Binance has since replaced compromised devices, reset credentials, rebuilt wallet systems, and engaged independent security firms for review. The FBI attributes the attack to TraderTraitor, a North Korean state-sponsored group, though North Korea denies involvement.

References

securityweek.com/rigged-coding-assignment-abused-ai-tool-opened-path-to-6-billion-binance-heist/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Nov 2026, 10:58 UTC

Technical details

References

Community reviews