In short. Binance found no evidence its keys leaked, yet the ledger shows its hot wallet signed 50 EIP-7702 authorizations letting it run the attacker’s code. Attackers have more ways in than any defender can close, but only a few systems can sign for a hot wallet, so we’d put the check there. If Binance’s review shows its signer refused delegations by default and the attacker found another path, we’d shift weight to the controls around it.
What this is. An incident reconstruction from Binance’s two statements, on-chain tracing by four firms, CoinDesk’s reading of the ledger, BleepingComputer’s account of the FBI alert and the EIP-7702 specification.
Contents
Binance’s own keys signed the theft
On the evening of 29 October 2026, attackers took about $6.34 billion from Binance’s hot wallets in about four hours. [1] Binance has found no sign that its private keys leaked. [2] Its own keys signed what the attackers needed. [6] One of those signatures set up a delegation that lived on the Ethereum ledger, outside the withdrawal system Binance shut off, so the suspension didn’t touch it. [1]
At 20:05 UTC, five Binance hot wallets began sending XRP to an address the attacker controlled. By 20:09 they had sent 233.46 million XRP. [1] Solana and Optimism wallets followed with about 970,500 SOL and about 44.2 million OP. [1] Only then, Binance says, did an internal alert about large transfers reach its team. Wallets on Base, Bitcoin and Tron sent funds out between 20:16 and 20:22. [6] The outflows included 18,270 BTC. [1]
Those outflows went out as ordinary signed transfers. [3] Meanwhile, on Ethereum, the attack on one hot wallet took a different form. At 20:20:59, one transaction carried 50 EIP-7702 authorizations for Binance 14, Etherscan’s label for a Binance Ethereum hot wallet. [7] EIP-7702 lets an ordinary account run a contract’s code. [38] Each authorization pointed Binance 14 at a sweeper, a contract built to empty wallets, which the attacker had deployed that afternoon. [6] One was enough.
The batch held that many because Binance 14 was still paying out customer withdrawals, so its nonce kept rising. The authorizations covered nonces 18,914,775 to 18,914,824. Only nonce 18,914,809 matched. [7] At 20:24:23 a single call through the hijacked wallet moved 167,464 ETH and 63 other tokens. [6]
Binance suspended withdrawals and began working with partners to freeze affected tokens. [1] Its own systems kept routing customer deposits into Binance 14, though, and the attacker swept the wallet four more times before midnight. [7][6] Binance cut the link at 00:10 UTC on 30 October, nearly four hours after the delegation began. It did so by authorizing the zero address, which clears a delegation. [1]
TRM Labs and Chainalysis call it the largest crypto theft on record. [3][5] By reported dollar value at the time of theft, that’s the record we claim. An appendix tests the wider claim that it’s the largest hack in history.
Most of that evening’s transfers can be checked on the public ledger. The harder question is how the attacker reached a signer at all.
Binance says the way in began in June
Only Binance has described the break-in. Everything below about the engineers rests on its account. Its report, written within days, names no products, keeps some technical details confidential and promises an independent review. [1]
Outsiders saw only parts of the story. Four tracing firms, TRM Labs, Elliptic, Chainalysis and Hypernative, watched the money move on public ledgers. TRM and Elliptic agree closely with Binance’s totals and mostly with its timeline. [3][4] So do Chainalysis and Hypernative. [5][6] None of them can see inside Binance. Even so, TRM and Hypernative both inferred a compromise of Binance’s hot-wallet signing before Binance named it. [3][6] Binance’s 3 November report bears them out. [1]
The FBI’s alert of 31 October, as BleepingComputer reports it, ties the theft to North Korean actors it tracks as TraderTraitor. [8][9] Two appendices set out the totals and the attribution.
Binance’s account grew between its two statements. On 30 October it pointed to a DevOps engineer’s possibly hacked laptop, used to reach a service container from which someone submitted unauthorized withdrawals. [2] By 3 November the laptop was one link in a campaign that began in June. [1] We read the two as compatible, since the later one is broader and both rest on Binance’s own investigation.
The campaign reached three engineers. In June 2026 Engineer A, on the Wallet DevOps team, looked for a popular AI coding tool and downloaded a tampered Homebrew install. Binance’s security team spotted the break-in, replaced A’s device and rotated every related credential. [1] By then, Binance says, the attacker already knew A’s role and who A worked with on the wallet team. [1]
In September the attackers came for Engineer B through a real job site where his profile mentioned Binance. A fake HR contact ran a live video interview and shared a social-media account full of personal photos and videos. Binance calls the approach the most advanced and deceptive it had seen. [1] A second round, with a supposed CEO, moved to a chat app. [1]
Near the end, Binance says, B was told to download a coding test onto his work computer. [1] Binance calls the test’s malware a zero-day that its endpoint tools missed at the time, and its security chief, Jimmy Su, told reporters the same. [1][10] Binance’s file log shows the setup script putting its own file in place of pyenv, the Python version manager Homebrew had installed on B’s machine. [1]
Binance says the swapped file ran commands and talked to a server the attacker controlled. It says the attacker also worked to hide the activity and remove traces. [1] We read this as persistence, since every later run of pyenv ran the attacker’s code. An appendix lists the file steps.
On 20 October, Binance says, the attacker used B’s computer and an internal AI tool to gain control over Engineer A and Engineer C, a wallet software engineer. On A’s computer it found a container deployment permission token. [1]
On 29 October, Binance says, the attacker used A’s stolen credentials on C’s computer, deployed a container and ran a malicious script between 17:15 and 19:56. It gives no time zone for this window. [1] It also says the attacker exploited unauthorized access to its internal wallet signing service, which let it start transactions outside the normal withdrawal process. [1]
The public ledger picks up the trail only on 28 October. The table marks what each step rests on.
| When | What happened | Rests on |
|---|---|---|
| June 2026 | Engineer A installs a tampered Homebrew. [1] | Binance |
| September 2026 | Engineer B’s coding test plants malware. [1] | Binance |
| 20 October | The attacker gains control over A and C. [1] | Binance |
| 28 October | Small sums from the mixer Tornado Cash fund an attacker wallet. [6] | Ledger |
| 29 October, 02:28 and 15:59 UTC | A test sweeper is tried on throwaway wallets; the live one is deployed at 15:59. [6][7] | Ledger |
| 29 October, 17:15 to 19:56 | From C’s computer, the attacker deploys a container and runs a malicious script. [1] | Binance |
| 29 October, 20:05 to 23:56 UTC | Signed transfers, the Ethereum delegation and five sweeps of Binance 14. [1][6][7] | Ledger and Binance |
| 30 October, 00:10 UTC | Binance clears the delegation. [1][7] | Ledger and Binance |
An appendix gives the full chronology, with who saw each step. Binance caught the June break-in and still lost. [1] The step it explains least is the one that joined the three engineers into a path.
The internal AI tool is the least-explained link
Binance gives its internal AI tool one sentence in its timeline. Its list of fixes adds one more line, saying Binance rebuilt the affected tool and its access controls. [1] The report never names the tool, says what it does or explains how the attacker used it to gain control over two engineers.
The record fits three sensible designs for an internal assistant. We can’t tell them apart.
- It may run AI agents on engineers’ machines with the right to run commands. Whoever controls the tool controls the machines.
- It may hold its users’ tokens or credentials. Whoever controls it holds their access.
- Colleagues, and their own agents, may act on what it tells them. An attacker who can speak through it can steer them.
Binance says the attacker gained control over the engineers, which points weakly to the first design; that’s our reading of one sentence.
Binance’s account describes people running a months-long campaign, with AI tools as the bait in June and the bridge on 20 October. [1] Microsoft’s assessment from the same week says North Korean AI use remains human-directed, not fully autonomous. [36] On our reading, calling this an AI attack points defenders at the wrong control.
The control that matters is what an AI tool may do, for whom, and with whose approval. An appendix collects other cases of AI tools that carried too much power.
Whatever the tool did, every path the attacker built led to one system. The signer said yes.
One signature outlived the freeze
EIP-7702 is why one signature could do so much. An authorization counts only if its nonce matches the account’s, so a wallet can sign ahead for nonces it hasn’t reached. [38]
Once used, an authorization stays in force. The account’s code points at the contract until the account signs a new authorization or delegates to the zero address. Anyone can submit the transaction that carries an authorization, but only the account’s key can sign one. The rule’s own text warns that a badly designed delegate can hand an attacker near-complete control of the account. [38]
Thieves found the rule fast. By early June 2025, Wintermute had found that more than 80% of EIP-7702 delegations pointed at copy-pasted sweeper code it nicknamed CrimeEnjoyor. [39]
On 29 October a hot wallet’s key signed 50 set-code authorizations, the EIP-7702 kind. They were for nonces the wallet hadn’t reached yet, and they pointed at a contract only a few hours old. [6]
Binance says the attackers sent 50 signing transactions, meant to manipulate the account nonce and set up the delegations. [1] On the public ledger, Hypernative and CoinDesk see one transaction carrying the same number of authorizations, one for each nonce in a row. [6][7] We think these are one event seen from two sides, though Binance hasn’t confirmed this.
Rotating keys wouldn’t have removed the delegation, because, as Hypernative notes, it belongs to the address rather than to a key. Through it, the attacker used Binance 14 to pull about $823 million in USDC from a smart account the wallet owned. [6] TRM reports that Circle froze the same amount at 21:04 UTC. [3]
The stablecoin issuer acted within minutes. Binance needed hours, because only a signature from the wallet’s own key could cancel the delegation. [38] That key sat in the same multi-party computation (MPC) system the attacker had been using, so Binance had no single private key for a quick revocation. It says it had to design and run a special procedure. [1]
Our breach-analysis essay argues that a reconstruction should start with whatever could still act after the first containment step. [52] On 29 October that was one on-chain authorization no Binance system held. An allowed signing operation created it. The attacker only chose where it pointed.
The signer is the narrowest door
The early stages give attackers more ways in than any defender can close. Binance says it blocked 57 suspected North Korea-linked cases this year, among them fake job interviews, fake developer tools, compromised packages and browser extensions, and fake video-call apps. [1] Socket had counted more than 1,700 malicious packages tied to Contagious Interview, a fake-interview scheme, by April 2026. [24]
In four earlier thefts, set out in an appendix, attackers also came in through a person or firm the victim trusted. We call the pattern borrowed authority, since each attacker used access a company had given to someone else. Every case ended at the system that moves money.
The last stage is different. Only a few systems can sign for a hot wallet, so it has few entrances. A rule there applies to every path that passes through it, including paths nobody has imagined yet. That’s why we think the last stages matter most.
The signer is the last point where a system can still refuse a transaction, whoever asked for it. If Binance never used EIP-7702 delegations in normal work, a rule could have refused any set-code authorization from a hot wallet. We think that rule would have cost Binance little and blocked the largest single sweep.
Hypernative, which sells this kind of check, says that for wallets signing through its Transaction Guard, a policy denying delegations to malicious contracts would have blocked the 20:20 delegation. That, it says, would also have stopped the roughly $2.57 billion sweep that followed. [6] That’s a vendor’s claim about its own kind of product, and we can’t test it.
We don’t know what Binance’s signing policy covered. Binance hasn’t said, only that it’s reviewing that coverage. [1] We take that to mean the coverage had gaps, though Binance doesn’t say where. A policy engine guards only the paths it sits on. BitGo’s documentation, for example, says its withdrawal policies apply only to transactions involving BitGo, and recovery transactions using the user and backup keys bypass them. [40]
Earlier stages matter too. Each had a control that could have limited it, though no single control would certainly have stopped the theft. The table gives one control for each stage and what limits it.
| Stage | Control that could have limited it | Limit or gap |
|---|---|---|
| Seeking an AI coding tool, an engineer installs a tampered Homebrew | Approved sources for developer and AI tools; check the address in any pasted install command | Binance caught it, but by then the attacker knew A’s role and colleagues. [1] |
| A fake interview puts code on a work laptop | Coding tests only in a throwaway virtual machine or on a non-company device | It rests on one person’s choice under social pressure. |
| Malware swaps pyenv inside the Homebrew folder | Watch developer-tool folders for changed programs | Homebrew’s opt-in provenance check runs at download. We infer it wouldn’t see this later rewrite. [42][43] |
| An internal AI tool gives the attacker two more engineers | Per-person actions, scoped credentials, approval on the target device | We don’t know how Binance’s tool worked. |
| A deployment token sits on a laptop | Short-lived, per-job tokens; no standing laptop deployment rights for systems that can reach a signer | The token’s type, scope and lifetime at Binance are unknown. |
| The attacker reaches the signing service | The signer checks which program calls and by what path, not just network location | Binance’s design is unpublished. |
| The hot wallet’s key signs 50 set-code authorizations | Refuse by default any type a hot wallet never uses; cap counts, nonce ranges, value | It works only if the systems that build and ship code can’t reach it. |
| The delegation outlives the freeze | List every on-chain power the wallets have granted; rehearse revoking each one | Revoking needs a signature from the system under attack. |
Half these limits rest on one person’s choice or on details Binance hasn’t published. An appendix gives the evidence behind each control. Endpoint and identity controls decide how often an attacker reaches the signer. The signer has to hold when they fail.
Put the deciding check at the signer
Assume that one day an attacker will hold a developer’s laptop, an AI tool’s access and a deployment token. Then put the deciding check where none of them can reach. Exchanges and custodians should build that check into the signer. It belongs inside the signing quorum, the parties who must approve a signature, and out of reach of the deployment plane, the systems that build and ship code.
The check should refuse what normal work never produces. We propose three rules for a hot wallet’s signer.
- Refuse set-code authorizations by default. Sign one only if it was approved in advance.
- Hold future-nonce batches for review. Batches of signatures for future nonces can be normal, so hold them rather than refuse them.
- Screen the contract and its age. Hypernative recommends screening every delegation before signing. [6] Above all, we’d refuse one pointing at a contract deployed hours earlier, as Binance 14’s sweeper was. [6]
The hot wallet’s key signed authorizations that all three rules would have flagged. That combination should open an investigation.
Firms should also treat a withdrawal freeze as the start of containment. Finishing it takes a live list of every on-chain authority their wallets have granted, delegations and token approvals included. It also takes a rehearsed, timed way to revoke each one through the MPC quorum.
Security teams own the earlier stages, and the table above lists their controls. To those we’d add one that Engineer A’s case teaches, which is to watch a hacked developer’s team for months.
Teams that build internal AI tools have the least public evidence to work from and, after 20 October, the most reason to act. An internal AI tool that can act on staff machines is a remote-administration system with a chat window. It should be built like one.
- Tie every action to the person who asked.
- Give the tool scoped, short-lived credentials instead of standing ones.
- Require approval on the target machine before the tool acts there.
- Keep a tamper-evident record of what the tool did, and of who asked.
The appendix on developer tools shows attackers abusing MCP servers, add-ons that give assistants tools, along with hooks and task files. Makers of AI coding tools should warn the user clearly when one appears that the user didn’t add through the client.
They should also make their real install path easy to confirm, with one canonical domain, signed packages and published checksums. And they should say so wherever people search, because their product names are now search-ad bait. [26][27]
Binance has promised an independent review. [1] The most useful part would cover what Binance has said least about. What did its signing policy cover, and why didn’t the signer refuse? A firm with a hot wallet needn’t wait for those answers. It can ask its own signer whether it would sign a set-code authorization pointing at a contract deployed this afternoon.
Scope and limits
- What we did
- We rebuilt the theft from Binance’s 30 October update and 3 November report, the on-chain work of TRM Labs, Elliptic, Chainalysis, Hypernative and CoinDesk, and the EIP-7702 text. We compared the dollar totals and mapped each stage of the campaign to a control that could have limited it.
- What we didn’t do
- We ran no experiment and tested no signing policy. We couldn’t open the FBI’s alert, so we rely on BleepingComputer’s account. We couldn’t check what Hypernative saw as it happened.
- Where the record is thin
- Every step before 28 October rests on Binance alone, as does the container step on 29 October. Most later steps can be checked on the public ledger. The dollar figures will move as freezes are reconciled and assets are repriced.
- What this can’t tell you
- How the internal AI tool gave the attacker control of two engineers, so our advice about such tools stays general. Whether Binance used EIP-7702 in normal work, whether its signer had a policy covering it, or whether the attacker went around one. Whether the malware was a zero-day. Whether an ad or lookalike page led Engineer A to the tampered Homebrew. We found no earlier public report tying install-command lures to North Korea, which may reflect what victims publish.
- Confidence
- High on the 50 authorizations and the delegation lasting nearly four hours, which the ledger shows. Lower on the intrusion chain, which rests on Binance alone, down to how the June and September break-ins connect. The attribution is the FBI’s, backed by three tracing firms and denied by North Korea.
- What would change our view
- Binance’s promised independent review. If it shows the signer refused delegations by default and the attacker found another path, we’d shift weight to the deployment and identity controls. If the internal AI tool was a minor convenience in an attack that would have worked anyway, we overstate its role.
- Corrections
- We log every correction, with its date, on How we work. Send one through a research enquiry.
Appendix
The totals, compared
We use Binance’s own count as the headline. [1] Three outside counts sit close to it.
| Source | Total taken | Frozen or intercepted | Chains |
|---|---|---|---|
| Binance | About $6.3 billion (30 Oct); about $6.34 billion (3 Nov) | About $3 billion (30 Oct); about $2.85 billion (3 Nov) | Not given as a count |
| TRM Labs | About $6.36 billion at transfer; about $6.23 billion at later prices | About $2.7 billion as of 00:30 UTC, 30 Oct | 10 |
| Elliptic | $6.43 billion at time of theft | $2.85 billion verified, 44% of the total | 11 |
| Chainalysis | About $6.4 billion | About $2.8 billion as of 3 Nov | Not given |
The gaps come partly from coverage, ten chains for TRM and eleven for Elliptic, and partly from pricing method. [3][4] Elliptic also leaves out $169 million that went after the suspension to long-established addresses with no link to the attacker. It says that appears to be Binance moving its own funds. [4]
Binance’s frozen figure has already moved once, and the company still calls it subject to reconciliation and price swings. [1] Its 3 November report says 98% of impacted token assets had been replenished as of 31 October. [1]
The attribution
The FBI sees intelligence we can’t. We couldn’t open the FBI’s page, so we rely on BleepingComputer’s account, which says the alert lists 628 addresses associated with the theft. [9]
Three tracing firms agree with the FBI. TRM and Chainalysis had already linked the theft to TraderTraitor. [3][9] Elliptic had reached the same view. [4] Chainalysis says its strongest evidence came as it watched the stolen funds mix with funds from the September 2026 Bitget theft. That theft had already been tied to North Korean actors. [5]
North Korea denies the attribution, in a statement by Kim Yo Jong carried by state media. [11] We haven’t seen the underlying evidence, so we treat the attribution as the FBI’s assessment, backed by independent on-chain work.
The record claim, tested
At about four times Bybit’s loss, the Binance theft is the largest crypto theft on record, as TRM Labs and Chainalysis say. [3][5] Elliptic goes further. It judges it almost certainly the biggest single theft of any kind, a nominal-dollar comparison it also made for Bybit in February 2025. [4][14] This one theft nearly matches Chainalysis’s $6.75 billion lower bound for North Korea’s entire crypto haul up to December 2025. [50]
The table sets it beside five earlier incidents, each as its sources report it.
| Incident | Year | Reported value | Kind of loss |
|---|---|---|---|
| Binance hot wallets | 2026 | About $6.34 billion impacted; about $2.85 billion frozen or intercepted [1] | Signed transfers |
| Bybit | 2025 | About $1.5 billion (FBI); $1.46 billion (Elliptic) [13][14] | Safe multisig wallet [15] |
| Ronin bridge | 2022 | $620 million per the FBI; Sky Mavis reported 173,600 ETH and 25.5 million USDC [51] | Bridge funds |
| Poly Network | 2021 | $611 million, most later returned [14] | Cross-chain protocol funds |
| Central Bank of Iraq | 2003 | About $1 billion in cash, nominal [49] | Cash, reportedly on Saddam Hussein’s order |
| NotPetya | 2017 | No theft value; the White House called it the most destructive and costly cyberattack in history [48] | Destruction |
TRM’s headline calls it the largest hack in history, but NotPetya, measured by damage, may outrank it. [3][48] That’s why the body claims only the narrower record.
Earlier thefts on borrowed authority
In each of these four thefts, attackers came in through a person or firm the victim trusted, and the public accounts describe no broken cryptography.
In July 2023 CoinsPaid lost more than $37 million after, by its account, an employee ran code for a fake job offer. [17] In May 2024 DMM Bitcoin lost bitcoin then worth $308 million. US and Japanese agencies say a North Korean actor likely used a hacked wallet-software firm to tamper with an employee’s real transaction request. [19]
In October 2024 Radiant Capital lost about $50 million after a developer opened a zipped PDF, carrying a macOS backdoor, from a fake former contractor. [18]
Bybit is the closest match. It lost about $1.5 billion on 21 February 2025, and five days later the FBI tied the theft to TraderTraitor. [13] The money sat in a Safe multisig wallet, and outside researchers found no flaw in Safe’s contracts or website source code. Relaying the Safe{Wallet} team’s early findings, the Safe Ecosystem Foundation said a hacked developer machine had been used to propose a disguised malicious transaction to Bybit’s Safe. [15]
Later findings, reported by The Hacker News, trace the hack to a Docker project on the developer’s Mac. Stolen AWS session tokens got the attackers past MFA, and they planted malicious JavaScript on the Safe{Wallet} site. [16]
The warnings are not new. Palo Alto Networks’ Unit 42 named one fake-recruiter scheme Contagious Interview in November 2023. [20] In September 2024 the FBI warned of North Korean fake recruiters asking candidates to run code. “Avoid taking pre-employment tests or executing code on company owned laptops or devices,” it advised. It also urged approvals from several unconnected networks before moving assets. [12]
In each case, the question is what checks borrowed authority when it reaches the system that moves money.
Developer tools as bait and target
One lure starts with a common habit, pasting an install command from a web page into Terminal, the standard way Homebrew installs. Its script explains what it will do and waits for the user to confirm, but its documentation describes no checksum or signature to check first. [41] In January 2025 a sponsored Google result posing as brew.sh sent people to brewe.sh and the AMOS stealer. [25]
In March 2026 Push Security described InstallFix, cloned install pages that swap in a malicious command. Its main example posed as Claude Code, and it cites hunt.io’s research on near-identical Homebrew clones. Push says four in five of the ClickFix lures it intercepts, the wider family of paste-a-command tricks, are reached from search engines. [26]
In May 2026 a sponsored Claude Code result led Beelzebub Labs to a fake Anthropic page whose pasted command installed MacSync Stealer. [27] As far as the reports show, the Homebrew and InstallFix lures carried commodity stealers, and none names a state actor. [25][26] The same holds for the MacSync case. [27]
Binance says only that Engineer A got the tampered Homebrew after a search for an AI coding tool, not whether an ad or lookalike page was involved. [1] If one was, Binance’s case may be the first public link between such lures and North Korea. We found no earlier one.
The better-known route is the fake interview. In Microsoft’s March 2026 analysis of Contagious Interview, recruiters posing as crypto-trading and AI firms ask candidates to clone a repository. In recent cases, once the candidate opens it in VS Code and trusts its author, the editor runs a task file that fetches the backdoor. [22] Jamf saw the same route on macOS in January 2026. [23]
Microsoft advises doing coding tests in an isolated environment, such as a non-persistent virtual machine. [22]
The developer’s AI tools have become targets too. In August 2025 malicious Nx versions tried to make local AI command-line tools hunt for secrets. [28] GitGuardian counted 366 systems where they tried and 95 where the AI tool wrote the requested file. [29]
In February 2026 Socket found npm packages planting a rogue MCP server, an add-on that gives assistants tools. Its tool descriptions told assistants to read SSH keys and AWS credentials without telling the user. [30] In August 2026 an npm worm tried to persist through Claude Code hooks and VS Code task files. [31]
In July 2025 an over-scoped GitHub token let an attacker slip malicious code into the Amazon Q Developer extension for VS Code. AWS says the code failed to run. [32]
On the day of the theft, Microsoft reported that North Korean clusters likely use AI development platforms such as Cursor. One of them, Jade Sleet, the TraderTraitor alias Unit 42 lists, posed as recruiters for a fake AI-powered blockchain intelligence company. [36][21] In August 2025 Anthropic reported that North Korean IT workers used Claude to build false identities, pass coding tests and do the work once hired. [34]
Other cases show how much power AI tools can carry. In a July 2025 General Analysis demonstration, a Cursor agent working through Supabase’s MCP server held a role that bypassed row-level security. A support ticket with planted instructions got it to leak integration tokens. “No permissions were violated,” the authors wrote. [33]
In November 2025 Anthropic reported that a group it assessed with high confidence as Chinese state-sponsored used Claude Code with MCP tools against about thirty targets. By its account the group succeeded in a small number of cases. Anthropic says Claude sometimes hallucinated credentials, a limit it calls an obstacle to fully autonomous attacks. [35]
In July 2026 Hugging Face disclosed a break-in that it says an autonomous AI agent system ran end to end, from a malicious dataset to cloud and cluster credentials. It says it doesn’t know which model ran the agents. [37]
The evidence behind each control
The body’s table gives one control and one limit for each stage. This one gives every control we’d suggest, the evidence and sources behind it, and each limit in full.
| Stage | Control that could have limited it | Evidence | Limit |
|---|---|---|---|
| June. Seeking an AI coding tool, an engineer installs a tampered Homebrew. | Approved sources for developer and AI tools. Staff check the address in any pasted install command. | Four in five ClickFix lures Push stops come from search. [26] Homebrew describes no checksum or signature for its install script. [41] | Binance caught it; the lasting harm was what the attacker learned. [1] |
| September. A fake interview puts code on a work laptop. | Coding tests only in a throwaway virtual machine or on a non-company device. VS Code’s Restricted Mode on for unknown projects. | FBI advice since 2024, and Microsoft’s in 2026. [12][22] Restricted Mode holds back tasks and agents until the user trusts the folder. [46] | It rests on one person’s choice under social pressure. The malware was reportedly a zero-day. [1][10] |
| The malware swaps pyenv inside the Homebrew prefix. | Watch developer tool folders for changed programs. Treat any user-writable package folder as a target. | Homebrew’s default prefix needs no sudo after setup, and Homebrew offers no security guarantees if untrusted users can write to it. [41] Bottle attestation, a provenance check, is opt-in and runs when a bottle is fetched. [42][43] | We infer that a provenance check at download wouldn’t see a later rewrite of an installed file. |
| 20 October. An internal AI tool gives the attacker two more engineers. | Per-person actions, scoped credentials and approval on the target device. | The Supabase demonstration agent acted within over-broad permissions; in Amazon Q, an over-scoped build token let an outsider ship code. [33][32] | We don’t know how Binance’s tool worked. |
| A deployment token sits on a laptop. | Short-lived, per-job tokens from an identity broker. No standing deployment rights on laptops for systems that can reach a signer. | Under GitHub’s OIDC design, the cloud provider issues a token valid for a single job. [45] In December 2025 npm moved publishing to two-hour sessions and capped write tokens at 90 days. [44] | The token’s type, scope and lifetime at Binance are unknown. |
| 29 October. The attacker reaches the signing service. | The signer checks which program calls and by what path, not just network location. Two people approve deployments near it. | Zero-trust guidance grants no implicit trust based solely on network location. [47] | It slows every release. Binance’s design is unpublished. |
| The hot wallet’s key signs 50 EIP-7702 authorizations. | Refuse by default any type a hot wallet never uses, set-code authorizations included. Cap counts, nonce ranges and value; require a quorum for new types. | The EIP-7702 text treats delegates as security-critical. [38] Hypernative recommends screening every delegation before signing. [6] | The policy has to live inside the signing quorum, the parties who must approve a signature, and out of reach of the deployment plane, the systems that build and ship code. |
| The delegation outlives the withdrawal freeze. | List every on-chain power the wallets have granted. Watch them for delegation code, which starts with 0xef0100. Rehearse revoking through the MPC quorum. | Binance describes a slow revocation it had to build on the spot. [1] The EIP describes clearing a delegation through the zero address. [38] | Revoking needs a signature from the system under attack. |
The pyenv swap
Binance’s file log shows four steps by the setup script on Engineer B’s machine. [1]
- It created a new file next to pyenv, in /opt/homebrew/Cellar/pyenv/2.8.0/libexec.
- It deleted the real pyenv and gave its own file that name.
- It replaced the pyenv link in /opt/homebrew/bin.
- It started a zsh shell.
The full chronology
The body’s short table marks what each step rests on. This one gives each main step from June to 3 November, and its last column names who saw each one.
| When | What happened | Seen by |
|---|---|---|
| June 2026 | Engineer A installs a tampered Homebrew. Binance replaces the device and rotates credentials. It says A’s role and colleagues were exposed. [1] | Binance |
| Through 2026 | Binance blocks 57 suspected North Korea-linked cases: fake job interviews, fake developer tools, compromised packages and browser extensions, fake video-call apps. [1] | Binance |
| September 2026 | A fake project director approaches Engineer B. His coding test swaps pyenv in the Homebrew Cellar and contacts an attacker server. Endpoint tools miss it. [1][10] | Binance |
| 20 October | Via B’s machine and an internal AI tool, the attacker gains control over A and Engineer C, a wallet software engineer. [1] | Binance |
| 28 October | Small sums from the mixer Tornado Cash fund an attacker wallet. Hypernative says it flagged the funding at 07:39 UTC. [6] | On-chain (Hypernative) |
| 29 October, 02:28 and 15:59 UTC | A test sweeper is tried on throwaway wallets; the live one is deployed at 15:59. [6][7] | On-chain (Hypernative; CoinDesk for the live contract) |
| 29 October, 17:15 to 19:56 | From C’s computer, the attacker uses A’s stolen credentials, deploys a container and runs a malicious script. Binance gives no time zone for this window. [1] | Binance |
| 29 October, 20:05 to 20:22 UTC | XRP, SOL, OP, Base, BTC and Tron leave. [1][6] They go out as ordinary signed transfers. [3] | Binance and on-chain |
| 29 October, 20:20:59 UTC | One transaction carries 50 EIP-7702 authorizations for Binance 14. One takes effect. [6][7] | On-chain |
| 29 October, 20:24:23 UTC | A sweep moves 167,464 ETH and 63 tokens. [6][7] | On-chain |
| 29 October, 21:04 to 23:56 UTC | Four more sweeps, at 21:04, 21:44, 22:39 and 23:56, while the delegation stays live. [6][7] The last unauthorized transfer, 2,961.9 ETH, was sent earlier and goes through at 23:56. [1][6] | Binance and on-chain |
| 30 October, 00:10 UTC | Binance clears the delegation by authorizing the zero address. [1][7] | Binance and on-chain |
| 31 October | The FBI ties the theft to North Korea’s TraderTraitor. [8][9] | FBI, via BleepingComputer |
| 3 November | Binance’s initial report says 98% of impacted token assets had been replenished as of 31 October. [1] | Binance |
Every row before 28 October rests on Binance alone, as does the 17:15 container row; most later rows can be checked on the public ledger.
The open question
Which requests should a hot-wallet signer refuse no matter who sends them, and how fast can an MPC custodian revoke an on-chain authority it should never have granted?
A dated reconstruction that keeps Binance’s account apart from the independent on-chain record, three rules a hot-wallet signer could enforce, and a stage-by-stage map of controls with the limit of each. Appendices test the claim that this is the largest hack in history and give the evidence behind each control. The next step we’d most like to see is a measured, published revocation drill for MPC hot wallets.
References
A selected review of published sources, with Lugano’s analysis and proposed work identified in the text. Source dates and conditions matter; historical results are not current-model rankings.
- 1
29 October 2026 Binance Security Incident: Initial Findings and Response Update
First-party initial incident report, also published as an X Article (x.com/binance/status/2117626126214504729) on 3 November 2026. Gives amounts, chain-by-chain transfers, the EIP-7702 and MPC containment account, the June-to-October attack chain, the pyenv file log, 57 blocked cases, and remediation.
Scope. The victim’s own account, written within days and before independent review. It withholds some technical details and names no products. We read the Binance Square copy and the X Article text; the post shows a 29 October date but includes facts dated up to 3 November.Back to the essay
- 2
Security Incident Update (2026-10-30)
First-party preliminary update: a possibly compromised DevOps engineer’s laptop used to reach a service container, no evidence of a wallet private-key leak, about $6.3 billion impacted and about $3 billion frozen.
Scope. Preliminary statement later broadened by Binance’s 3 November report.Back to the essay
- 3
North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
Independent on-chain analysis: totals at transfer and current prices, per-chain breakdown, freeze timestamps by issuer, which outflows used EIP-7702 versus ordinary signed transfers, laundering, and attribution reasoning.
Scope. Data as of 00:30 UTC on 30 October; written before Binance described its signing service. The headline says largest hack in history while the body says largest crypto theft on record.Back to the essay
- 4
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack
Independent on-chain analysis: $6.43 billion at time of theft across 11 chains, $2.85 billion (44%) verified frozen, exclusion of $169 million judged to be Binance’s own movements, laundering patterns, and comparison with Bybit and the 2003 Central Bank of Iraq theft.
Scope. Last updated 1 November 2026. Its any-kind comparison uses nominal dollars. Elliptic sells blockchain analytics.Back to the essay
- 5
Binance Hack: Tracing the $6.4 Billion Theft to North Korea
Independent analysis: about $6.4 billion taken, about $2.8 billion frozen as of 3 November, attribution to TraderTraitor based on commingling with Bitget-theft funds, and laundering observations.
Scope. Vendor analysis; the underlying attribution data are not public.Back to the essay
- 6
Inside the Largest Crypto Theft of All-Time: The $6.3B Binance Hot-Wallet Drain
Independent on-chain timeline: Tornado Cash funding, sweeper deployments, per-chain outflow times, the 50-authorization transaction, the delegated sweeps, the $823 million USDC pull, and recommendations for signing and delegation controls.
Scope. Published 30 October 2026 by a monitoring vendor that promotes its own products; its counterfactual about blocking the delegation is its own analysis and untested here.Back to the essay
- 7
Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss
Independent reading of Etherscan data: sweeper deployment, the 50 authorizations over nonces 18,914,775 to 18,914,824, the accepted nonce 18,914,809, deposit sweeps and the 00:10:35 UTC revocation.
Scope. Journalism; non-Ethereum figures and some labels are attributed to TRM Labs and Etherscan.Back to the essay
- 8
North Korea Responsible for $6 Billion+ Binance Attack
Government attribution of the theft to North Korean actors tracked as TraderTraitor.
Scope. We couldn’t open this page, so its content is cited here only as BleepingComputer [9] reports it.Back to the essay
- 9
FBI links $6.3 billion Binance crypto heist to North Korean hackers
Secondhand account of the FBI alert: TraderTraitor attribution, more than $6 billion, 628 addresses associated with the theft, a request from the FBI, Secret Service and IRS-CI that exchanges block linked transactions, and the group’s other names including Jade Sleet.
Scope. Secondhand; we rely on it because we couldn’t open the FBI’s own page.Back to the essay
- 10
Binance’s $6.3 billion hack began with a fake job interview, and a campaign ‘built over many months’
Report of Binance’s 3 November media briefing, attributing the timeline and the zero-day malware description to chief security officer Jimmy Su and the campaign description to Richard Teng.
Scope. Secondhand account of first-party statements; no outside expert analysis.Back to the essay
- 11
North Korea denies links to Binance hack as stolen billions are traced
North Korea’s denial via state media; Elliptic’s laundering figures, including about $3.24 billion remaining in linked addresses and about $786 million in stablecoins converted before freezes.
Scope. Secondhand report of Elliptic’s figures and of KCNA’s statement.Back to the essay
- 12
North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)
Government advisory on fake recruiters and pre-employment tests, with mitigations including not running test code on company devices, multiple approvals from unconnected networks before moving assets, and limiting access to business or product development pipelines and company code repositories.
Scope. General advisory; it does not evaluate how well each mitigation works.Back to the essay
- 13
North Korea Responsible for $1.5 Billion Bybit Hack (I-022625-PSA)
Government attribution of the roughly $1.5 billion Bybit theft of 21 February 2025 to TraderTraitor.
Scope. Does not describe the initial access path.Back to the essay
- 14
The largest theft in history - following the money trail from the Bybit Hack
Independent analysis valuing the Bybit theft at about $1.46 billion, calling it the largest theft of any kind, and citing Poly Network’s $611 million 2021 theft.
Scope. Nominal-dollar comparison; superseded as a record by the Binance theft.Back to the essay
- 15
February 28th, 2025: Statement by the Safe Ecosystem Foundation
Statement relaying the Safe{Wallet} team’s preliminary findings that a compromised Safe{Wallet} developer machine was used to propose a disguised malicious transaction to the Bybit Safe, with no vulnerabilities found in Safe contracts or front-end source.
Scope. The Foundation says it does not operate Safe{Wallet} and relays that team’s preliminary findings; it names no forensic firm and gives no technical detail of the initial compromise.Back to the essay
- 16
Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist
Secondhand account of Safe’s findings: a developer’s Mac compromised on 4 February 2025 through a Docker project, AWS session hijacking that bypassed MFA, and JavaScript injected into the Safe{Wallet} site from 19 to 21 February.
Scope. Secondhand; we haven’t seen Safe’s own posts on X.Back to the essay
- 17
CoinsPaid claims North Korean hacking group used fake job interview to steal $37M
Secondhand account of CoinsPaid’s explanation of a July 2023 theft: an employee ran code during a fake job interview and attackers imitated legitimate requests to blockchain interaction interfaces.
Scope. Secondhand report of a victim’s claims; the attribution is CoinsPaid’s suspicion.Back to the essay
- 18
Radiant Capital Says North Korean Hackers Behind $50 Million Attack in October
Secondhand account of Radiant’s update: a Telegram lure from a fake former contractor, a zipped PDF carrying a macOS backdoor, Mandiant’s attribution to UNC4736, and checks that showed no obvious discrepancies.
Scope. Secondhand; we haven’t seen Radiant’s own posts.Back to the essay
- 19
FBI attributes largest crypto hack of 2024 to North Korea’s TraderTraitor
Report of the FBI, US Defense Department and Japanese National Police Agency attribution of the DMM Bitcoin theft, including the wallet-software company compromise and manipulated transaction request.
Scope. Secondhand; we haven’t read the FBI release itself, and the article does not describe the initial compromise of the wallet-software firm.Back to the essay
- 20
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Vendor threat research naming Contagious Interview: fake employers, npm packages from GitHub, and the BeaverTail and InvisibleFerret malware, which searched for wallet extensions including Binance’s.
Scope. Vendor research from 2023; not evidence about the Binance intrusion.Back to the essay
- 21
Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
Vendor research on the group also known as Jade Sleet and TraderTraitor: LinkedIn recruiter lures, GitHub coding challenges, payloads served only to validated targets, and a macOS stealer taking keychain, SSH and cloud configuration files.
Scope. Describes specific campaigns; not evidence about Binance.Back to the essay
- 22
Contagious Interview: Malware delivered through fake developer job interviews
Vendor research on recruiter lures, repository execution through npm and VS Code task configuration after workspace trust, stolen data types, and mitigations including isolated environments for coding tests.
Scope. Microsoft’s view of its own telemetry; it hedges on whether code traits show AI-assisted development.Back to the essay
- 23
Threat Actors Expand Abuse of Microsoft Visual Studio Code
Vendor research on malicious interview repositories that run tasks.json after VS Code workspace trust and fetch a JavaScript payload on macOS.
Scope. Vendor research on specific samples.Back to the essay
- 24
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
Vendor count of more than 1,700 malicious packages linked to Contagious Interview across npm, PyPI, Go, crates.io and Packagist.
Scope. Cumulative tracker figure; we haven’t seen Socket’s tracker page itself.Back to the essay
- 25
Dangerous macOS malware is spread via fake Homebrew ads
Report of a January 2025 sponsored Google result imitating brew.sh that led to brewe.sh and the AMOS stealer.
Scope. No attribution to any actor; a short-lived campaign.Back to the essay
- 26
InstallFix: How attackers are weaponizing malvertised install guides
Vendor research on cloned install pages for Claude Code and Homebrew spread through sponsored search results, payload behavior, and Push’s observation that four in five intercepted lures came from search engines.
Scope. Vendor telemetry from its own customers; no attribution to a state actor.Back to the essay
- 27
MacSync Stealer: How a Google Ad Turned Install Claude Code into Full Mac Compromise
Analysis of a May 2026 sponsored result for a Claude Code macOS install leading to MacSync Stealer, with the data it steals.
Scope. Single-case analysis; no actor attribution.Back to the essay
- 28
S1ngularity - What Happened, How We Responded, What We Learned
First-party postmortem of the August 2025 Nx compromise: root cause, about four hours of exposure, about six million weekly installs, attempted use of local AI tools such as Claude and Gemini, and remediation.
Scope. First-party; it does not give the exact AI CLI commands, which vendor analyses report.Back to the essay
- 29
The Nx s1ngularity Attack: Inside the Credential Leak
Independent measurement: AI tools targeted on 366 systems, 95 producing the requested inventory file, some refusals, and leaked-secret counts.
Scope. Based on what was visible in public exfiltration repositories; it uses one figure for both systems and repositories in different places.Back to the essay
- 30
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
Vendor research on npm packages, including Claude Code lookalikes, that write a rogue MCP server into AI coding tool settings whose tool descriptions instruct the assistant to gather secrets.
Scope. No actor attribution; behavior reported from Socket’s analysis.Back to the essay
- 31
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Vendor research on an August 2026 worm reaching more than 400 npm packages that attempts persistence through Claude Code hooks and VS Code tasks.json and targets AI-agent credential stores.
Scope. No named actor; counts from an evolving investigation.Back to the essay
- 32
Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)
First-party bulletin: an inappropriately scoped GitHub token in CodeBuild let an actor commit code that shipped in version 1.84.0; the code failed to execute; fixed in 1.85.0 (CVE-2025-8217).
Scope. First-party; does not reproduce the malicious code.Back to the essay
- 33
Supabase MCP Security: How Prompt Injection Leaked Private Tables
Demonstration that a Cursor agent using a Supabase MCP server under a role that bypasses row-level security could be steered by a support ticket into leaking integration tokens.
Scope. A controlled demonstration with dummy data, not an observed attack.Back to the essay
- 34
Detecting and countering misuse of AI: August 2025
First-party threat report that North Korean IT workers used Claude to create false identities, pass coding assessments and do technical work.
Scope. Vendor report on its own platform; it does not describe intrusion activity by these operators.Back to the essay
- 35
Disrupting an AI-orchestrated cyber espionage campaign
First-party report of a group assessed as Chinese state-sponsored using Claude Code with MCP tools, with AI doing most of the work, harvesting credentials, and sometimes hallucinating them.
Scope. Vendor account of its own platform; not independently verified.Back to the essay
- 36
Tracking AI adoption in North Korean threat actor tradecraft
Vendor assessment of AI use by North Korean clusters, including likely use of Cursor, Coral Sleet’s repository-trojanizing workflow, Jade Sleet’s AI-themed recruiter lures, and the judgment that operations remain human-directed.
Scope. Does not mention Binance, Homebrew, MCP or internal AI assistants.Back to the essay
- 37
Security incident disclosure — July 2026
First-party disclosure of an intrusion it describes as driven end to end by an autonomous AI agent system, entering through a malicious dataset and harvesting cloud and cluster credentials.
Scope. First-party; the model and operator behind the agent are unknown.Back to the essay
- 38
EIP-7702: Set Code for EOAs
Final specification: authorization tuple format, delegation indicator, nonce rule, persistence, clearing by delegating to the zero address, sponsorship, and security considerations for delegates and wallets.
Scope. A protocol specification; it does not describe any custodian’s controls.Back to the essay
- 39
Wintermute warns Pectra upgrade leaves Ethereum users at risk of automated attacks
Secondhand report of Wintermute’s finding that more than 80% of EIP-7702 delegations went to copy-pasted sweeper code it called CrimeEnjoyor.
Scope. Secondhand; we haven’t seen Wintermute’s own post and dashboard.Back to the essay
- 40
Policies Overview
Vendor documentation of withdrawal policy types and scope, including that policies apply only to transactions involving BitGo and that recovery transactions bypass them.
Scope. Documentation of one vendor’s product, read on 3 November 2026; not evidence about Binance’s custody design.Back to the essay
- 41
Installation
Official installation guidance: default prefixes chosen so sudo is not needed after installation, the warning that Homebrew offers no security guarantees when untrusted users can write to the prefix, and an install script and .pkg with no described checksum step.
Scope. Read on 3 November 2026; documentation can change.Back to the essay
- 42
Homebrew manpage (environment) and Library/Homebrew/env_config.rb
Documents HOMEBREW_VERIFY_ATTESTATIONS as applying if set, and brew verify as a provenance check that needs the GitHub CLI; the source on the main branch (github.com/Homebrew/brew) shows the setting has no default and is checked when bottles are fetched.
Scope. We read documentation and source on 3 November 2026; developer-mode behavior may differ.Back to the essay
- 43
A peek into build provenance for Homebrew
Describes attestations binding homebrew-core bottles to the CI workflow that built them, then early beta and not recommended for ordinary users, and notes provenance will not stop a fully malicious maintainer.
Scope. Describes the 2024 state of the feature.Back to the essay
- 44
npm classic tokens revoked, session-based auth and CLI token management now available
Official change notice: classic npm tokens revoked, two-hour login sessions with 2FA for publishing, and write tokens limited to 90 days.
Scope. Applies to npm publishing, not to deployment systems generally.Back to the essay
- 45
OpenID Connect
Official documentation of OIDC for GitHub Actions: no stored cloud secrets, granular trust conditions, and access tokens valid for a single job.
Scope. Describes one CI platform’s mechanism; not evidence about Binance’s deployment tokens.Back to the essay
- 46
Workspace Trust
Official documentation that Restricted Mode limits AI agents, the terminal, tasks, debugging, workspace settings and extensions until a folder is trusted.
Scope. Read on 3 November 2026; it gives no guidance on virtual machines.Back to the essay
- 47
Zero Trust Architecture (NIST SP 800-207)
Official architecture guidance that grants no implicit trust based on network location or asset ownership.
Scope. Architecture guidance, not evidence that a given control would have prevented this theft.Back to the essay
- 48
Statement from the Press Secretary (NotPetya)
Government statement attributing NotPetya to the Russian military and describing it as the most destructive and costly cyberattack in history.
Scope. Gives no specific dollar figure, only “billions of dollars in damage”; a political statement as well as an assessment.Back to the essay
- 49
Saddam Set Bank Heist Record: Report
Report, citing The New York Times and a US Treasury official, of about $1 billion in cash removed from Iraq’s central bank on 18 March 2003.
Scope. Secondhand report from 2003; nominal dollars.Back to the essay
- 50
2025 Crypto Theft Reaches $3.4 Billion
Annual analysis: over $3.4 billion stolen in 2025, at least $2.02 billion by North Korea, and a cumulative North Korean lower bound of $6.75 billion.
Scope. Covers January to early December 2025; lower-bound estimates.Back to the essay
- 51
FBI links largest crypto hack ever to North Korean hackers
Report of the FBI’s attribution of the Ronin bridge theft ($620 million in Ethereum) to Lazarus and APT38, with Sky Mavis’s figures of 173,600 ETH and 25.5 million USDC stolen.
Scope. Secondhand report of an FBI statement.Back to the essay
- 52
What actually failed in a breach?
Lugano research report on reconstructing incidents around the credentials that can still act.
Scope. A research report with an experiment design we haven’t run.Back to the essay