How did a developer’s toolbox become the way into Binance?
Lugano Labs | Open research · Research report
Editor: Brian D. Evans (https://lugano.ai/method/#editor)
First prepared 3 November 2026; revised 4 November 2026
Current theses and questions may change with new evidence. We welcome corrections and outside review.

Attackers took about $6.34 billion from Binance, and Binance’s account describes no broken cryptography. The trail, it says, starts in June with an engineer’s search for an AI coding tool.

In short
Binance found no evidence its keys leaked, yet the ledger shows its hot wallet signed 50 EIP-7702 authorizations letting it run the attacker’s code. Attackers have more ways in than any defender can close, but only a few systems can sign for a hot wallet, so we’d put the check there. If Binance’s review shows its signer refused delegations by default and the attacker found another path, we’d shift weight to the controls around it.

What this is
An incident reconstruction from Binance’s two statements, on-chain tracing by four firms, CoinDesk’s reading of the ledger, BleepingComputer’s account of the FBI alert and the EIP-7702 specification.

BINANCE’S OWN KEYS SIGNED THE THEFT

On the evening of 29 October 2026, attackers took about $6.34 billion from Binance’s hot wallets in about four hours. [1] Binance has found no sign that its private keys leaked. [2] Its own keys signed what the attackers needed. [6] One of those signatures set up a delegation that lived on the Ethereum ledger, outside the withdrawal system Binance shut off, so the suspension didn’t touch it. [1]

At 20:05 UTC, five Binance hot wallets began sending XRP to an address the attacker controlled. By 20:09 they had sent 233.46 million XRP. [1] Solana and Optimism wallets followed with about 970,500 SOL and about 44.2 million OP. [1] Only then, Binance says, did an internal alert about large transfers reach its team. Wallets on Base, Bitcoin and Tron sent funds out between 20:16 and 20:22. [6] The outflows included 18,270 BTC. [1]

Those outflows went out as ordinary signed transfers. [3] Meanwhile, on Ethereum, the attack on one hot wallet took a different form. At 20:20:59, one transaction carried 50 EIP-7702 authorizations for Binance 14, Etherscan’s label for a Binance Ethereum hot wallet. [7] EIP-7702 lets an ordinary account run a contract’s code. [38] Each authorization pointed Binance 14 at a sweeper, a contract built to empty wallets, which the attacker had deployed that afternoon. [6] One was enough.

The batch held that many because Binance 14 was still paying out customer withdrawals, so its nonce kept rising. The authorizations covered nonces 18,914,775 to 18,914,824. Only nonce 18,914,809 matched. [7] At 20:24:23 a single call through the hijacked wallet moved 167,464 ETH and 63 other tokens. [6]

Binance suspended withdrawals and began working with partners to freeze affected tokens. [1] Its own systems kept routing customer deposits into Binance 14, though, and the attacker swept the wallet four more times before midnight. [7][6] Binance cut the link at 00:10 UTC on 30 October, nearly four hours after the delegation began. It did so by authorizing the zero address, which clears a delegation. [1]

TRM Labs and Chainalysis call it the largest crypto theft on record. [3][5] By reported dollar value at the time of theft, that’s the record we claim. An appendix tests the wider claim that it’s the largest hack in history.

Most of that evening’s transfers can be checked on the public ledger. The harder question is how the attacker reached a signer at all.

BINANCE SAYS THE WAY IN BEGAN IN JUNE

Only Binance has described the break-in. Everything below about the engineers rests on its account. Its report, written within days, names no products, keeps some technical details confidential and promises an independent review. [1]

Outsiders saw only parts of the story. Four tracing firms, TRM Labs, Elliptic, Chainalysis and Hypernative, watched the money move on public ledgers. TRM and Elliptic agree closely with Binance’s totals and mostly with its timeline. [3][4] So do Chainalysis and Hypernative. [5][6] None of them can see inside Binance. Even so, TRM and Hypernative both inferred a compromise of Binance’s hot-wallet signing before Binance named it. [3][6] Binance’s 3 November report bears them out. [1]

The FBI’s alert of 31 October, as BleepingComputer reports it, ties the theft to North Korean actors it tracks as TraderTraitor. [8][9] Two appendices set out the totals and the attribution.

Binance’s account grew between its two statements. On 30 October it pointed to a DevOps engineer’s possibly hacked laptop, used to reach a service container from which someone submitted unauthorized withdrawals. [2] By 3 November the laptop was one link in a campaign that began in June. [1] We read the two as compatible, since the later one is broader and both rest on Binance’s own investigation.

The campaign reached three engineers. In June 2026 Engineer A, on the Wallet DevOps team, looked for a popular AI coding tool and downloaded a tampered Homebrew install. Binance’s security team spotted the break-in, replaced A’s device and rotated every related credential. [1] By then, Binance says, the attacker already knew A’s role and who A worked with on the wallet team. [1]

In September the attackers came for Engineer B through a real job site where his profile mentioned Binance. A fake HR contact ran a live video interview and shared a social-media account full of personal photos and videos. Binance calls the approach the most advanced and deceptive it had seen. [1] A second round, with a supposed CEO, moved to a chat app. [1]

Near the end, Binance says, B was told to download a coding test onto his work computer. [1] Binance calls the test’s malware a zero-day that its endpoint tools missed at the time, and its security chief, Jimmy Su, told reporters the same. [1][10] Binance’s file log shows the setup script putting its own file in place of pyenv, the Python version manager Homebrew had installed on B’s machine. [1]

Binance says the swapped file ran commands and talked to a server the attacker controlled. It says the attacker also worked to hide the activity and remove traces. [1] We read this as persistence, since every later run of pyenv ran the attacker’s code. An appendix lists the file steps.

On 20 October, Binance says, the attacker used B’s computer and an internal AI tool to gain control over Engineer A and Engineer C, a wallet software engineer. On A’s computer it found a container deployment permission token. [1]

On 29 October, Binance says, the attacker used A’s stolen credentials on C’s computer, deployed a container and ran a malicious script between 17:15 and 19:56. It gives no time zone for this window. [1] It also says the attacker exploited unauthorized access to its internal wallet signing service, which let it start transactions outside the normal withdrawal process. [1]

The public ledger picks up the trail only on 28 October. The table marks what each step rests on.

What each step rests on | When | What happened | Rests on

 | June 2026 | Engineer A installs a tampered Homebrew. [1] | Binance

 | September 2026 | Engineer B’s coding test plants malware. [1] | Binance

 | 20 October | The attacker gains control over A and C. [1] | Binance

 | 28 October | Small sums from the mixer Tornado Cash fund an attacker wallet. [6] | Ledger

 | 29 October, 02:28 and 15:59 UTC | A test sweeper is tried on throwaway wallets; the live one is deployed at 15:59. [6][7] | Ledger

 | 29 October, 17:15 to 19:56 | From C’s computer, the attacker deploys a container and runs a malicious script. [1] | Binance

 | 29 October, 20:05 to 23:56 UTC | Signed transfers, the Ethereum delegation and five sweeps of Binance 14. [1][6][7] | Ledger and Binance

 | 30 October, 00:10 UTC | Binance clears the delegation. [1][7] | Ledger and Binance

An appendix gives the full chronology, with who saw each step. Binance caught the June break-in and still lost. [1] The step it explains least is the one that joined the three engineers into a path.

THE INTERNAL AI TOOL IS THE LEAST-EXPLAINED LINK

Binance gives its internal AI tool one sentence in its timeline. Its list of fixes adds one more line, saying Binance rebuilt the affected tool and its access controls. [1] The report never names the tool, says what it does or explains how the attacker used it to gain control over two engineers.

The record fits three sensible designs for an internal assistant. We can’t tell them apart.

It may run AI agents on engineers’ machines with the right to run commands. Whoever controls the tool controls the machines.

It may hold its users’ tokens or credentials. Whoever controls it holds their access.

Colleagues, and their own agents, may act on what it tells them. An attacker who can speak through it can steer them.

Binance says the attacker gained control over the engineers, which points weakly to the first design; that’s our reading of one sentence.

Binance’s account describes people running a months-long campaign, with AI tools as the bait in June and the bridge on 20 October. [1] Microsoft’s assessment from the same week says North Korean AI use remains human-directed, not fully autonomous. [36] On our reading, calling this an AI attack points defenders at the wrong control.

The control that matters is what an AI tool may do, for whom, and with whose approval. An appendix collects other cases of AI tools that carried too much power.

Whatever the tool did, every path the attacker built led to one system. The signer said yes.

ONE SIGNATURE OUTLIVED THE FREEZE

EIP-7702 is why one signature could do so much. An authorization counts only if its nonce matches the account’s, so a wallet can sign ahead for nonces it hasn’t reached. [38]

Once used, an authorization stays in force. The account’s code points at the contract until the account signs a new authorization or delegates to the zero address. Anyone can submit the transaction that carries an authorization, but only the account’s key can sign one. The rule’s own text warns that a badly designed delegate can hand an attacker near-complete control of the account. [38]

Thieves found the rule fast. By early June 2025, Wintermute had found that more than 80% of EIP-7702 delegations pointed at copy-pasted sweeper code it nicknamed CrimeEnjoyor. [39]

On 29 October a hot wallet’s key signed 50 set-code authorizations, the EIP-7702 kind. They were for nonces the wallet hadn’t reached yet, and they pointed at a contract only a few hours old. [6]

Binance says the attackers sent 50 signing transactions, meant to manipulate the account nonce and set up the delegations. [1] On the public ledger, Hypernative and CoinDesk see one transaction carrying the same number of authorizations, one for each nonce in a row. [6][7] We think these are one event seen from two sides, though Binance hasn’t confirmed this.

Rotating keys wouldn’t have removed the delegation, because, as Hypernative notes, it belongs to the address rather than to a key. Through it, the attacker used Binance 14 to pull about $823 million in USDC from a smart account the wallet owned. [6] TRM reports that Circle froze the same amount at 21:04 UTC. [3]

The stablecoin issuer acted within minutes. Binance needed hours, because only a signature from the wallet’s own key could cancel the delegation. [38] That key sat in the same multi-party computation (MPC) system the attacker had been using, so Binance had no single private key for a quick revocation. It says it had to design and run a special procedure. [1]

Our breach-analysis essay argues that a reconstruction should start with whatever could still act after the first containment step. [52] On 29 October that was one on-chain authorization no Binance system held. An allowed signing operation created it. The attacker only chose where it pointed.

THE SIGNER IS THE NARROWEST DOOR

The early stages give attackers more ways in than any defender can close. Binance says it blocked 57 suspected North Korea-linked cases this year, among them fake job interviews, fake developer tools, compromised packages and browser extensions, and fake video-call apps. [1] Socket had counted more than 1,700 malicious packages tied to Contagious Interview, a fake-interview scheme, by April 2026. [24]

In four earlier thefts, set out in an appendix, attackers also came in through a person or firm the victim trusted. We call the pattern borrowed authority, since each attacker used access a company had given to someone else. Every case ended at the system that moves money.

The last stage is different. Only a few systems can sign for a hot wallet, so it has few entrances. A rule there applies to every path that passes through it, including paths nobody has imagined yet. That’s why we think the last stages matter most.

The signer is the last point where a system can still refuse a transaction, whoever asked for it. If Binance never used EIP-7702 delegations in normal work, a rule could have refused any set-code authorization from a hot wallet. We think that rule would have cost Binance little and blocked the largest single sweep.

Hypernative, which sells this kind of check, says that for wallets signing through its Transaction Guard, a policy denying delegations to malicious contracts would have blocked the 20:20 delegation. That, it says, would also have stopped the roughly $2.57 billion sweep that followed. [6] That’s a vendor’s claim about its own kind of product, and we can’t test it.

We don’t know what Binance’s signing policy covered. Binance hasn’t said, only that it’s reviewing that coverage. [1] We take that to mean the coverage had gaps, though Binance doesn’t say where. A policy engine guards only the paths it sits on. BitGo’s documentation, for example, says its withdrawal policies apply only to transactions involving BitGo, and recovery transactions using the user and backup keys bypass them. [40]

Earlier stages matter too. Each had a control that could have limited it, though no single control would certainly have stopped the theft. The table gives one control for each stage and what limits it.

A control for each stage, and what limits it | Stage | Control that could have limited it | Limit or gap

 | Seeking an AI coding tool, an engineer installs a tampered Homebrew | Approved sources for developer and AI tools; check the address in any pasted install command | Binance caught it, but by then the attacker knew A’s role and colleagues. [1]

 | A fake interview puts code on a work laptop | Coding tests only in a throwaway virtual machine or on a non-company device | It rests on one person’s choice under social pressure.

 | Malware swaps pyenv inside the Homebrew folder | Watch developer-tool folders for changed programs | Homebrew’s opt-in provenance check runs at download. We infer it wouldn’t see this later rewrite. [42][43]

 | An internal AI tool gives the attacker two more engineers | Per-person actions, scoped credentials, approval on the target device | We don’t know how Binance’s tool worked.

 | A deployment token sits on a laptop | Short-lived, per-job tokens; no standing laptop deployment rights for systems that can reach a signer | The token’s type, scope and lifetime at Binance are unknown.

 | The attacker reaches the signing service | The signer checks which program calls and by what path, not just network location | Binance’s design is unpublished.

 | The hot wallet’s key signs 50 set-code authorizations | Refuse by default any type a hot wallet never uses; cap counts, nonce ranges, value | It works only if the systems that build and ship code can’t reach it.

 | The delegation outlives the freeze | List every on-chain power the wallets have granted; rehearse revoking each one | Revoking needs a signature from the system under attack.

Half these limits rest on one person’s choice or on details Binance hasn’t published. An appendix gives the evidence behind each control. Endpoint and identity controls decide how often an attacker reaches the signer. The signer has to hold when they fail.

PUT THE DECIDING CHECK AT THE SIGNER

Assume that one day an attacker will hold a developer’s laptop, an AI tool’s access and a deployment token. Then put the deciding check where none of them can reach. Exchanges and custodians should build that check into the signer. It belongs inside the signing quorum, the parties who must approve a signature, and out of reach of the deployment plane, the systems that build and ship code.

The check should refuse what normal work never produces. We propose three rules for a hot wallet’s signer.

Refuse set-code authorizations by default. Sign one only if it was approved in advance.

Hold future-nonce batches for review. Batches of signatures for future nonces can be normal, so hold them rather than refuse them.

Screen the contract and its age. Hypernative recommends screening every delegation before signing. [6] Above all, we’d refuse one pointing at a contract deployed hours earlier, as Binance 14’s sweeper was. [6]

The hot wallet’s key signed authorizations that all three rules would have flagged. That combination should open an investigation.

Firms should also treat a withdrawal freeze as the start of containment. Finishing it takes a live list of every on-chain authority their wallets have granted, delegations and token approvals included. It also takes a rehearsed, timed way to revoke each one through the MPC quorum.

Security teams own the earlier stages, and the table above lists their controls. To those we’d add one that Engineer A’s case teaches, which is to watch a hacked developer’s team for months.

Teams that build internal AI tools have the least public evidence to work from and, after 20 October, the most reason to act. An internal AI tool that can act on staff machines is a remote-administration system with a chat window. It should be built like one.

Tie every action to the person who asked.

Give the tool scoped, short-lived credentials instead of standing ones.

Require approval on the target machine before the tool acts there.

Keep a tamper-evident record of what the tool did, and of who asked.

The appendix on developer tools shows attackers abusing MCP servers, add-ons that give assistants tools, along with hooks and task files. Makers of AI coding tools should warn the user clearly when one appears that the user didn’t add through the client.

They should also make their real install path easy to confirm, with one canonical domain, signed packages and published checksums. And they should say so wherever people search, because their product names are now search-ad bait. [26][27]

Binance has promised an independent review. [1] The most useful part would cover what Binance has said least about. What did its signing policy cover, and why didn’t the signer refuse? A firm with a hot wallet needn’t wait for those answers. It can ask its own signer whether it would sign a set-code authorization pointing at a contract deployed this afternoon.

SCOPE AND LIMITS

What we did
We rebuilt the theft from Binance’s 30 October update and 3 November report, the on-chain work of TRM Labs, Elliptic, Chainalysis, Hypernative and CoinDesk, and the EIP-7702 text. We compared the dollar totals and mapped each stage of the campaign to a control that could have limited it.

What we didn’t do
We ran no experiment and tested no signing policy. We couldn’t open the FBI’s alert, so we rely on BleepingComputer’s account. We couldn’t check what Hypernative saw as it happened.

Where the record is thin
Every step before 28 October rests on Binance alone, as does the container step on 29 October. Most later steps can be checked on the public ledger. The dollar figures will move as freezes are reconciled and assets are repriced.

What this can’t tell you
How the internal AI tool gave the attacker control of two engineers, so our advice about such tools stays general. Whether Binance used EIP-7702 in normal work, whether its signer had a policy covering it, or whether the attacker went around one. Whether the malware was a zero-day. Whether an ad or lookalike page led Engineer A to the tampered Homebrew. We found no earlier public report tying install-command lures to North Korea, which may reflect what victims publish.

Confidence
High on the 50 authorizations and the delegation lasting nearly four hours, which the ledger shows. Lower on the intrusion chain, which rests on Binance alone, down to how the June and September break-ins connect. The attribution is the FBI’s, backed by three tracing firms and denied by North Korea.

What would change our view
Binance’s promised independent review. If it shows the signer refused delegations by default and the attacker found another path, we’d shift weight to the deployment and identity controls. If the internal AI tool was a minor convenience in an attack that would have worked anyway, we overstate its role.

Corrections
We log every correction, with its date, on How we work (https://lugano.ai/method/#corrections).

APPENDIX

THE TOTALS, COMPARED

We use Binance’s own count as the headline. [1] Three outside counts sit close to it.

Four counts of the theft | Source | Total taken | Frozen or intercepted | Chains

 | Binance | About $6.3 billion (30 Oct); about $6.34 billion (3 Nov) | About $3 billion (30 Oct); about $2.85 billion (3 Nov) | Not given as a count

 | TRM Labs | About $6.36 billion at transfer; about $6.23 billion at later prices | About $2.7 billion as of 00:30 UTC, 30 Oct | 10

 | Elliptic | $6.43 billion at time of theft | $2.85 billion verified, 44% of the total | 11

 | Chainalysis | About $6.4 billion | About $2.8 billion as of 3 Nov | Not given

The gaps come partly from coverage, ten chains for TRM and eleven for Elliptic, and partly from pricing method. [3][4] Elliptic also leaves out $169 million that went after the suspension to long-established addresses with no link to the attacker. It says that appears to be Binance moving its own funds. [4]

Binance’s frozen figure has already moved once, and the company still calls it subject to reconciliation and price swings. [1] Its 3 November report says 98% of impacted token assets had been replenished as of 31 October. [1]

THE ATTRIBUTION

The FBI sees intelligence we can’t. We couldn’t open the FBI’s page, so we rely on BleepingComputer’s account, which says the alert lists 628 addresses associated with the theft. [9]

Three tracing firms agree with the FBI. TRM and Chainalysis had already linked the theft to TraderTraitor. [3][9] Elliptic had reached the same view. [4] Chainalysis says its strongest evidence came as it watched the stolen funds mix with funds from the September 2026 Bitget theft. That theft had already been tied to North Korean actors. [5]

North Korea denies the attribution, in a statement by Kim Yo Jong carried by state media. [11] We haven’t seen the underlying evidence, so we treat the attribution as the FBI’s assessment, backed by independent on-chain work.

THE RECORD CLAIM, TESTED

At about four times Bybit’s loss, the Binance theft is the largest crypto theft on record, as TRM Labs and Chainalysis say. [3][5] Elliptic goes further. It judges it almost certainly the biggest single theft of any kind, a nominal-dollar comparison it also made for Bybit in February 2025. [4][14] This one theft nearly matches Chainalysis’s $6.75 billion lower bound for North Korea’s entire crypto haul up to December 2025. [50]

The table sets it beside five earlier incidents, each as its sources report it.

The Binance theft beside five earlier incidents | Incident | Year | Reported value | Kind of loss

 | Binance hot wallets | 2026 | About $6.34 billion impacted; about $2.85 billion frozen or intercepted [1] | Signed transfers

 | Bybit | 2025 | About $1.5 billion (FBI); $1.46 billion (Elliptic) [13][14] | Safe multisig wallet [15]

 | Ronin bridge | 2022 | $620 million per the FBI; Sky Mavis reported 173,600 ETH and 25.5 million USDC [51] | Bridge funds

 | Poly Network | 2021 | $611 million, most later returned [14] | Cross-chain protocol funds

 | Central Bank of Iraq | 2003 | About $1 billion in cash, nominal [49] | Cash, reportedly on Saddam Hussein’s order

 | NotPetya | 2017 | No theft value; the White House called it the most destructive and costly cyberattack in history [48] | Destruction

TRM’s headline calls it the largest hack in history, but NotPetya, measured by damage, may outrank it. [3][48] That’s why the body claims only the narrower record.

EARLIER THEFTS ON BORROWED AUTHORITY

In each of these four thefts, attackers came in through a person or firm the victim trusted, and the public accounts describe no broken cryptography.

In July 2023 CoinsPaid lost more than $37 million after, by its account, an employee ran code for a fake job offer. [17] In May 2024 DMM Bitcoin lost bitcoin then worth $308 million. US and Japanese agencies say a North Korean actor likely used a hacked wallet-software firm to tamper with an employee’s real transaction request. [19]

In October 2024 Radiant Capital lost about $50 million after a developer opened a zipped PDF, carrying a macOS backdoor, from a fake former contractor. [18]

Bybit is the closest match. It lost about $1.5 billion on 21 February 2025, and five days later the FBI tied the theft to TraderTraitor. [13] The money sat in a Safe multisig wallet, and outside researchers found no flaw in Safe’s contracts or website source code. Relaying the Safe{Wallet} team’s early findings, the Safe Ecosystem Foundation said a hacked developer machine had been used to propose a disguised malicious transaction to Bybit’s Safe. [15]

Later findings, reported by The Hacker News, trace the hack to a Docker project on the developer’s Mac. Stolen AWS session tokens got the attackers past MFA, and they planted malicious JavaScript on the Safe{Wallet} site. [16]

The warnings are not new. Palo Alto Networks’ Unit 42 named one fake-recruiter scheme Contagious Interview in November 2023. [20] In September 2024 the FBI warned of North Korean fake recruiters asking candidates to run code. “Avoid taking pre-employment tests or executing code on company owned laptops or devices,” it advised. It also urged approvals from several unconnected networks before moving assets. [12]

In each case, the question is what checks borrowed authority when it reaches the system that moves money.

DEVELOPER TOOLS AS BAIT AND TARGET

One lure starts with a common habit, pasting an install command from a web page into Terminal, the standard way Homebrew installs. Its script explains what it will do and waits for the user to confirm, but its documentation describes no checksum or signature to check first. [41] In January 2025 a sponsored Google result posing as brew.sh sent people to brewe.sh and the AMOS stealer. [25]

In March 2026 Push Security described InstallFix, cloned install pages that swap in a malicious command. Its main example posed as Claude Code, and it cites hunt.io’s research on near-identical Homebrew clones. Push says four in five of the ClickFix lures it intercepts, the wider family of paste-a-command tricks, are reached from search engines. [26]

In May 2026 a sponsored Claude Code result led Beelzebub Labs to a fake Anthropic page whose pasted command installed MacSync Stealer. [27] As far as the reports show, the Homebrew and InstallFix lures carried commodity stealers, and none names a state actor. [25][26] The same holds for the MacSync case. [27]

Binance says only that Engineer A got the tampered Homebrew after a search for an AI coding tool, not whether an ad or lookalike page was involved. [1] If one was, Binance’s case may be the first public link between such lures and North Korea. We found no earlier one.

The better-known route is the fake interview. In Microsoft’s March 2026 analysis of Contagious Interview, recruiters posing as crypto-trading and AI firms ask candidates to clone a repository. In recent cases, once the candidate opens it in VS Code and trusts its author, the editor runs a task file that fetches the backdoor. [22] Jamf saw the same route on macOS in January 2026. [23]

Microsoft advises doing coding tests in an isolated environment, such as a non-persistent virtual machine. [22]

The developer’s AI tools have become targets too. In August 2025 malicious Nx versions tried to make local AI command-line tools hunt for secrets. [28] GitGuardian counted 366 systems where they tried and 95 where the AI tool wrote the requested file. [29]

In February 2026 Socket found npm packages planting a rogue MCP server, an add-on that gives assistants tools. Its tool descriptions told assistants to read SSH keys and AWS credentials without telling the user. [30] In August 2026 an npm worm tried to persist through Claude Code hooks and VS Code task files. [31]

In July 2025 an over-scoped GitHub token let an attacker slip malicious code into the Amazon Q Developer extension for VS Code. AWS says the code failed to run. [32]

On the day of the theft, Microsoft reported that North Korean clusters likely use AI development platforms such as Cursor. One of them, Jade Sleet, the TraderTraitor alias Unit 42 lists, posed as recruiters for a fake AI-powered blockchain intelligence company. [36][21] In August 2025 Anthropic reported that North Korean IT workers used Claude to build false identities, pass coding tests and do the work once hired. [34]

Other cases show how much power AI tools can carry. In a July 2025 General Analysis demonstration, a Cursor agent working through Supabase’s MCP server held a role that bypassed row-level security. A support ticket with planted instructions got it to leak integration tokens. “No permissions were violated,” the authors wrote. [33]

In November 2025 Anthropic reported that a group it assessed with high confidence as Chinese state-sponsored used Claude Code with MCP tools against about thirty targets. By its account the group succeeded in a small number of cases. Anthropic says Claude sometimes hallucinated credentials, a limit it calls an obstacle to fully autonomous attacks. [35]

In July 2026 Hugging Face disclosed a break-in that it says an autonomous AI agent system ran end to end, from a malicious dataset to cloud and cluster credentials. It says it doesn’t know which model ran the agents. [37]

THE EVIDENCE BEHIND EACH CONTROL

The body’s table gives one control and one limit for each stage. This one gives every control we’d suggest, the evidence and sources behind it, and each limit in full.

Controls by stage, with the evidence and limit for each | Stage | Control that could have limited it | Evidence | Limit

 | June. Seeking an AI coding tool, an engineer installs a tampered Homebrew. | Approved sources for developer and AI tools. Staff check the address in any pasted install command. | Four in five ClickFix lures Push stops come from search. [26] Homebrew describes no checksum or signature for its install script. [41] | Binance caught it; the lasting harm was what the attacker learned. [1]

 | September. A fake interview puts code on a work laptop. | Coding tests only in a throwaway virtual machine or on a non-company device. VS Code’s Restricted Mode on for unknown projects. | FBI advice since 2024, and Microsoft’s in 2026. [12][22] Restricted Mode holds back tasks and agents until the user trusts the folder. [46] | It rests on one person’s choice under social pressure. The malware was reportedly a zero-day. [1][10]

 | The malware swaps pyenv inside the Homebrew prefix. | Watch developer tool folders for changed programs. Treat any user-writable package folder as a target. | Homebrew’s default prefix needs no sudo after setup, and Homebrew offers no security guarantees if untrusted users can write to it. [41] Bottle attestation, a provenance check, is opt-in and runs when a bottle is fetched. [42][43] | We infer that a provenance check at download wouldn’t see a later rewrite of an installed file.

 | 20 October. An internal AI tool gives the attacker two more engineers. | Per-person actions, scoped credentials and approval on the target device. | The Supabase demonstration agent acted within over-broad permissions; in Amazon Q, an over-scoped build token let an outsider ship code. [33][32] | We don’t know how Binance’s tool worked.

 | A deployment token sits on a laptop. | Short-lived, per-job tokens from an identity broker. No standing deployment rights on laptops for systems that can reach a signer. | Under GitHub’s OIDC design, the cloud provider issues a token valid for a single job. [45] In December 2025 npm moved publishing to two-hour sessions and capped write tokens at 90 days. [44] | The token’s type, scope and lifetime at Binance are unknown.

 | 29 October. The attacker reaches the signing service. | The signer checks which program calls and by what path, not just network location. Two people approve deployments near it. | Zero-trust guidance grants no implicit trust based solely on network location. [47] | It slows every release. Binance’s design is unpublished.

 | The hot wallet’s key signs 50 EIP-7702 authorizations. | Refuse by default any type a hot wallet never uses, set-code authorizations included. Cap counts, nonce ranges and value; require a quorum for new types. | The EIP-7702 text treats delegates as security-critical. [38] Hypernative recommends screening every delegation before signing. [6] | The policy has to live inside the signing quorum, the parties who must approve a signature, and out of reach of the deployment plane, the systems that build and ship code.

 | The delegation outlives the withdrawal freeze. | List every on-chain power the wallets have granted. Watch them for delegation code, which starts with 0xef0100. Rehearse revoking through the MPC quorum. | Binance describes a slow revocation it had to build on the spot. [1] The EIP describes clearing a delegation through the zero address. [38] | Revoking needs a signature from the system under attack.

THE PYENV SWAP

Binance’s file log shows four steps by the setup script on Engineer B’s machine. [1]

It created a new file next to pyenv, in /opt/homebrew/Cellar/pyenv/2.8.0/libexec.

It deleted the real pyenv and gave its own file that name.

It replaced the pyenv link in /opt/homebrew/bin.

It started a zsh shell.

THE FULL CHRONOLOGY

The body’s short table marks what each step rests on. This one gives each main step from June to 3 November, and its last column names who saw each one.

Each main step, June to 3 November 2026, and who saw it | When | What happened | Seen by

 | June 2026 | Engineer A installs a tampered Homebrew. Binance replaces the device and rotates credentials. It says A’s role and colleagues were exposed. [1] | Binance

 | Through 2026 | Binance blocks 57 suspected North Korea-linked cases: fake job interviews, fake developer tools, compromised packages and browser extensions, fake video-call apps. [1] | Binance

 | September 2026 | A fake project director approaches Engineer B. His coding test swaps pyenv in the Homebrew Cellar and contacts an attacker server. Endpoint tools miss it. [1][10] | Binance

 | 20 October | Via B’s machine and an internal AI tool, the attacker gains control over A and Engineer C, a wallet software engineer. [1] | Binance

 | 28 October | Small sums from the mixer Tornado Cash fund an attacker wallet. Hypernative says it flagged the funding at 07:39 UTC. [6] | On-chain (Hypernative)

 | 29 October, 02:28 and 15:59 UTC | A test sweeper is tried on throwaway wallets; the live one is deployed at 15:59. [6][7] | On-chain (Hypernative; CoinDesk for the live contract)

 | 29 October, 17:15 to 19:56 | From C’s computer, the attacker uses A’s stolen credentials, deploys a container and runs a malicious script. Binance gives no time zone for this window. [1] | Binance

 | 29 October, 20:05 to 20:22 UTC | XRP, SOL, OP, Base, BTC and Tron leave. [1][6] They go out as ordinary signed transfers. [3] | Binance and on-chain

 | 29 October, 20:20:59 UTC | One transaction carries 50 EIP-7702 authorizations for Binance 14. One takes effect. [6][7] | On-chain

 | 29 October, 20:24:23 UTC | A sweep moves 167,464 ETH and 63 tokens. [6][7] | On-chain

 | 29 October, 21:04 to 23:56 UTC | Four more sweeps, at 21:04, 21:44, 22:39 and 23:56, while the delegation stays live. [6][7] The last unauthorized transfer, 2,961.9 ETH, was sent earlier and goes through at 23:56. [1][6] | Binance and on-chain

 | 30 October, 00:10 UTC | Binance clears the delegation by authorizing the zero address. [1][7] | Binance and on-chain

 | 31 October | The FBI ties the theft to North Korea’s TraderTraitor. [8][9] | FBI, via BleepingComputer

 | 3 November | Binance’s initial report says 98% of impacted token assets had been replenished as of 31 October. [1] | Binance

Every row before 28 October rests on Binance alone, as does the 17:15 container row; most later rows can be checked on the public ledger.

THE OPEN QUESTION
Which requests should a hot-wallet signer refuse no matter who sends them, and how fast can an MPC custodian revoke an on-chain authority it should never have granted?

A dated reconstruction that keeps Binance’s account apart from the independent on-chain record, three rules a hot-wallet signer could enforce, and a stage-by-stage map of controls with the limit of each. Appendices test the claim that this is the largest hack in history and give the evidence behind each control. The next step we’d most like to see is a measured, published revocation drill for MPC hot wallets.

SOURCES
[1] 29 October 2026 Binance Security Incident: Initial Findings and Response Update
Binance | 2026
https://www.binance.com/en/square/post/384312159834579
First-party initial incident report, also published as an X Article (x.com/binance/status/2117626126214504729) on 3 November 2026. Gives amounts, chain-by-chain transfers, the EIP-7702 and MPC containment account, the June-to-October attack chain, the pyenv file log, 57 blocked cases, and remediation.
Scope: The victim’s own account, written within days and before independent review. It withholds some technical details and names no products. We read the Binance Square copy and the X Article text; the post shows a 29 October date but includes facts dated up to 3 November.

[2] Security Incident Update (2026-10-30)
Binance | 2026
https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
First-party preliminary update: a possibly compromised DevOps engineer’s laptop used to reach a service container, no evidence of a wallet private-key leak, about $6.3 billion impacted and about $3 billion frozen.
Scope: Preliminary statement later broadened by Binance’s 3 November report.

[3] North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
TRM Labs | 2026
https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
Independent on-chain analysis: totals at transfer and current prices, per-chain breakdown, freeze timestamps by issuer, which outflows used EIP-7702 versus ordinary signed transfers, laundering, and attribution reasoning.
Scope: Data as of 00:30 UTC on 30 October; written before Binance described its signing service. The headline says largest hack in history while the body says largest crypto theft on record.

[4] The largest theft in history: North Korea likely behind the $6.4 billion Binance hack
Tom Robinson, Elliptic | 2026
https://www.elliptic.co/insights/binance-largest-hack-in-history/
Independent on-chain analysis: $6.43 billion at time of theft across 11 chains, $2.85 billion (44%) verified frozen, exclusion of $169 million judged to be Binance’s own movements, laundering patterns, and comparison with Bybit and the 2003 Central Bank of Iraq theft.
Scope: Last updated 1 November 2026. Its any-kind comparison uses nominal dollars. Elliptic sells blockchain analytics.

[5] Binance Hack: Tracing the $6.4 Billion Theft to North Korea
Chainalysis | 2026
https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
Independent analysis: about $6.4 billion taken, about $2.8 billion frozen as of 3 November, attribution to TraderTraitor based on commingling with Bitget-theft funds, and laundering observations.
Scope: Vendor analysis; the underlying attribution data are not public.

[6] Inside the Largest Crypto Theft of All-Time: The $6.3B Binance Hot-Wallet Drain
Hypernative | 2026
https://www.hypernative.io/insights/blog/inside-the-largest-crypto-theft-of-all-time-the-6-3b-binance-hot-wallet-drain
Independent on-chain timeline: Tornado Cash funding, sweeper deployments, per-chain outflow times, the 50-authorization transaction, the delegated sweeps, the $823 million USDC pull, and recommendations for signing and delegation controls.
Scope: Published 30 October 2026 by a monitoring vendor that promotes its own products; its counterfactual about blocking the delegation is its own analysis and untested here.

[7] Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss
Shaurya Malwa, CoinDesk | 2026
https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance
Independent reading of Etherscan data: sweeper deployment, the 50 authorizations over nonces 18,914,775 to 18,914,824, the accepted nonce 18,914,809, deposit sweeps and the 00:10:35 UTC revocation.
Scope: Journalism; non-Ethereum figures and some labels are attributed to TRM Labs and Etherscan.

[8] North Korea Responsible for $6 Billion+ Binance Attack
Federal Bureau of Investigation | 2026
https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack
Government attribution of the theft to North Korean actors tracked as TraderTraitor.
Scope: We couldn’t open this page, so its content is cited here only as BleepingComputer [9] reports it.

[9] FBI links $6.3 billion Binance crypto heist to North Korean hackers
Lawrence Abrams, BleepingComputer | 2026
https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/
Secondhand account of the FBI alert: TraderTraitor attribution, more than $6 billion, 628 addresses associated with the theft, a request from the FBI, Secret Service and IRS-CI that exchanges block linked transactions, and the group’s other names including Jade Sleet.
Scope: Secondhand; we rely on it because we couldn’t open the FBI’s own page.

[10] Binance’s $6.3 billion hack began with a fake job interview, and a campaign ‘built over many months’
Oliver Knight, CoinDesk | 2026
https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says
Report of Binance’s 3 November media briefing, attributing the timeline and the zero-day malware description to chief security officer Jimmy Su and the campaign description to Richard Teng.
Scope: Secondhand account of first-party statements; no outside expert analysis.

[11] North Korea denies links to Binance hack as stolen billions are traced
Jenny Lee, CNBC | 2026
https://www.cnbc.com/2026/11/03/north-korea-binance-elliptic-chainalysis.html
North Korea’s denial via state media; Elliptic’s laundering figures, including about $3.24 billion remaining in linked addresses and about $786 million in stablecoins converted before freezes.
Scope: Secondhand report of Elliptic’s figures and of KCNA’s statement.

[12] North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)
Federal Bureau of Investigation, IC3 | 2024
https://www.ic3.gov/PSA/2024/PSA240903
Government advisory on fake recruiters and pre-employment tests, with mitigations including not running test code on company devices, multiple approvals from unconnected networks before moving assets, and limiting access to business or product development pipelines and company code repositories.
Scope: General advisory; it does not evaluate how well each mitigation works.

[13] North Korea Responsible for $1.5 Billion Bybit Hack (I-022625-PSA)
Federal Bureau of Investigation, IC3 | 2025
https://www.ic3.gov/PSA/2025/PSA250226
Government attribution of the roughly $1.5 billion Bybit theft of 21 February 2025 to TraderTraitor.
Scope: Does not describe the initial access path.

[14] The largest theft in history - following the money trail from the Bybit Hack
Elliptic | 2025
https://www.elliptic.co/blog/bybit-hack-largest-in-history
Independent analysis valuing the Bybit theft at about $1.46 billion, calling it the largest theft of any kind, and citing Poly Network’s $611 million 2021 theft.
Scope: Nominal-dollar comparison; superseded as a record by the Binance theft.

[15] February 28th, 2025: Statement by the Safe Ecosystem Foundation
Safe Ecosystem Foundation | 2025
https://safefoundation.org/blog/safe-ecosystem-foundation-statement
Statement relaying the Safe{Wallet} team’s preliminary findings that a compromised Safe{Wallet} developer machine was used to propose a disguised malicious transaction to the Bybit Safe, with no vulnerabilities found in Safe contracts or front-end source.
Scope: The Foundation says it does not operate Safe{Wallet} and relays that team’s preliminary findings; it names no forensic firm and gives no technical detail of the initial compromise.

[16] Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist
Ravie Lakshmanan, The Hacker News | 2025
https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html
Secondhand account of Safe’s findings: a developer’s Mac compromised on 4 February 2025 through a Docker project, AWS session hijacking that bypassed MFA, and JavaScript injected into the Safe{Wallet} site from 19 to 21 February.
Scope: Secondhand; we haven’t seen Safe’s own posts on X.

[17] CoinsPaid claims North Korean hacking group used fake job interview to steal $37M
Turner Wright, Cointelegraph | 2023
https://cointelegraph.com/news/coinspaid-claims-north-korean-hacking-group-fake-job-interview-theft
Secondhand account of CoinsPaid’s explanation of a July 2023 theft: an employee ran code during a fake job interview and attackers imitated legitimate requests to blockchain interaction interfaces.
Scope: Secondhand report of a victim’s claims; the attribution is CoinsPaid’s suspicion.

[18] Radiant Capital Says North Korean Hackers Behind $50 Million Attack in October
Callan Quinn, CoinDesk | 2024
https://www.coindesk.com/tech/2024/12/09/radiant-capital-says-north-korean-hackers-behind-50-million-attack-in-october
Secondhand account of Radiant’s update: a Telegram lure from a fake former contractor, a zipped PDF carrying a macOS backdoor, Mandiant’s attribution to UNC4736, and checks that showed no obvious discrepancies.
Scope: Secondhand; we haven’t seen Radiant’s own posts.

[19] FBI attributes largest crypto hack of 2024 to North Korea’s TraderTraitor
Jonathan Greig, The Record | 2024
https://therecord.media/fbi-largest-crypto-hack-2024-tradertraitor
Report of the FBI, US Defense Department and Japanese National Police Agency attribution of the DMM Bitcoin theft, including the wallet-software company compromise and manipulated transaction request.
Scope: Secondhand; we haven’t read the FBI release itself, and the article does not describe the initial compromise of the wallet-software firm.

[20] Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Unit 42, Palo Alto Networks | 2023
https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
Vendor threat research naming Contagious Interview: fake employers, npm packages from GitHub, and the BeaverTail and InvisibleFerret malware, which searched for wallet extensions including Binance’s.
Scope: Vendor research from 2023; not evidence about the Binance intrusion.

[21] Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
Prashil Pattni, Unit 42 | 2025
https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
Vendor research on the group also known as Jade Sleet and TraderTraitor: LinkedIn recruiter lures, GitHub coding challenges, payloads served only to validated targets, and a macOS stealer taking keychain, SSH and cloud configuration files.
Scope: Describes specific campaigns; not evidence about Binance.

[22] Contagious Interview: Malware delivered through fake developer job interviews
Microsoft Defender Experts | 2026
https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/
Vendor research on recruiter lures, repository execution through npm and VS Code task configuration after workspace trust, stolen data types, and mitigations including isolated environments for coding tests.
Scope: Microsoft’s view of its own telemetry; it hedges on whether code traits show AI-assisted development.

[23] Threat Actors Expand Abuse of Microsoft Visual Studio Code
Thijs Xhaflaire, Jamf Threat Labs | 2026
https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/
Vendor research on malicious interview repositories that run tasks.json after VS Code workspace trust and fetch a JavaScript payload on macOS.
Scope: Vendor research on specific samples.

[24] North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
Kirill Boychenko, Socket | 2026
https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems
Vendor count of more than 1,700 malicious packages linked to Contagious Interview across npm, PyPI, Go, crates.io and Packagist.
Scope: Cumulative tracker figure; we haven’t seen Socket’s tracker page itself.

[25] Dangerous macOS malware is spread via fake Homebrew ads
Ray Fernandez, Moonlock | 2025
https://moonlock.com/macos-malware-homebrew-ads
Report of a January 2025 sponsored Google result imitating brew.sh that led to brewe.sh and the AMOS stealer.
Scope: No attribution to any actor; a short-lived campaign.

[26] InstallFix: How attackers are weaponizing malvertised install guides
Jacques Louw, Push Security | 2026
https://pushsecurity.com/blog/installfix
Vendor research on cloned install pages for Claude Code and Homebrew spread through sponsored search results, payload behavior, and Push’s observation that four in five intercepted lures came from search engines.
Scope: Vendor telemetry from its own customers; no attribution to a state actor.

[27] MacSync Stealer: How a Google Ad Turned Install Claude Code into Full Mac Compromise
Giovanni Braccini, Beelzebub Labs | 2026
https://beelzebub.ai/blog/macsync-stealer-fake-claude-code-google-ads/
Analysis of a May 2026 sponsored result for a Claude Code macOS install leading to MacSync Stealer, with the data it steals.
Scope: Single-case analysis; no actor attribution.

[28] S1ngularity - What Happened, How We Responded, What We Learned
Juri Strumpflohner, Nx | 2025
https://nx.dev/blog/s1ngularity-postmortem
First-party postmortem of the August 2025 Nx compromise: root cause, about four hours of exposure, about six million weekly installs, attempted use of local AI tools such as Claude and Gemini, and remediation.
Scope: First-party; it does not give the exact AI CLI commands, which vendor analyses report.

[29] The Nx s1ngularity Attack: Inside the Credential Leak
Guillaume Valadon and Anna Nabiullina, GitGuardian | 2025
https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/
Independent measurement: AI tools targeted on 366 systems, 95 producing the requested inventory file, some refusals, and leaked-secret counts.
Scope: Based on what was visible in public exfiltration repositories; it uses one figure for both systems and repositories in different places.

[30] SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
Socket Research Team | 2026
https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning
Vendor research on npm packages, including Claude Code lookalikes, that write a rogue MCP server into AI coding tool settings whose tool descriptions instruct the assistant to gather secrets.
Scope: No actor attribution; behavior reported from Socket’s analysis.

[31] keyv and cacheable npm Package Hijacked in Supply Chain Attack
Merav Bar and Rami McCarthy, Wiz | 2026
https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Vendor research on an August 2026 worm reaching more than 400 npm packages that attempts persistence through Claude Code hooks and VS Code tasks.json and targets AI-agent credential stores.
Scope: No named actor; counts from an evolving investigation.

[32] Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)
Amazon Web Services | 2025
https://aws.amazon.com/security/security-bulletins/AWS-2025-015/
First-party bulletin: an inappropriately scoped GitHub token in CodeBuild let an actor commit code that shipped in version 1.84.0; the code failed to execute; fixed in 1.85.0 (CVE-2025-8217).
Scope: First-party; does not reproduce the malicious code.

[33] Supabase MCP Security: How Prompt Injection Leaked Private Tables
Rez Havaei, Rex Liu and Maximilian Li, General Analysis | 2025
https://www.generalanalysis.com/blog/supabase-mcp-blog
Demonstration that a Cursor agent using a Supabase MCP server under a role that bypasses row-level security could be steered by a support ticket into leaking integration tokens.
Scope: A controlled demonstration with dummy data, not an observed attack.

[34] Detecting and countering misuse of AI: August 2025
Anthropic | 2025
https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
First-party threat report that North Korean IT workers used Claude to create false identities, pass coding assessments and do technical work.
Scope: Vendor report on its own platform; it does not describe intrusion activity by these operators.

[35] Disrupting an AI-orchestrated cyber espionage campaign
Anthropic | 2025
https://www.anthropic.com/news/disrupting-AI-espionage
First-party report of a group assessed as Chinese state-sponsored using Claude Code with MCP tools, with AI doing most of the work, harvesting credentials, and sometimes hallucinating them.
Scope: Vendor account of its own platform; not independently verified.

[36] Tracking AI adoption in North Korean threat actor tradecraft
Microsoft Threat Intelligence | 2026
https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
Vendor assessment of AI use by North Korean clusters, including likely use of Cursor, Coral Sleet’s repository-trojanizing workflow, Jade Sleet’s AI-themed recruiter lures, and the judgment that operations remain human-directed.
Scope: Does not mention Binance, Homebrew, MCP or internal AI assistants.

[37] Security incident disclosure — July 2026
Hugging Face | 2026
https://huggingface.co/blog/security-incident-july-2026
First-party disclosure of an intrusion it describes as driven end to end by an autonomous AI agent system, entering through a malicious dataset and harvesting cloud and cluster credentials.
Scope: First-party; the model and operator behind the agent are unknown.

[38] EIP-7702: Set Code for EOAs
Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient | 2024
https://eips.ethereum.org/EIPS/eip-7702
Final specification: authorization tuple format, delegation indicator, nonce rule, persistence, clearing by delegating to the zero address, sponsorship, and security considerations for delegates and wallets.
Scope: A protocol specification; it does not describe any custodian’s controls.

[39] Wintermute warns Pectra upgrade leaves Ethereum users at risk of automated attacks
Zack Abrams, The Block | 2025
https://www.theblock.co/post/356481/wintermute-warns-pectra-upgrade-leaves-ethereum-users-at-risk-of-automated-attacks
Secondhand report of Wintermute’s finding that more than 80% of EIP-7702 delegations went to copy-pasted sweeper code it called CrimeEnjoyor.
Scope: Secondhand; we haven’t seen Wintermute’s own post and dashboard.

[40] Policies Overview
BitGo developer documentation | 2026
https://developers.bitgo.com/docs/policies-overview
Vendor documentation of withdrawal policy types and scope, including that policies apply only to transactions involving BitGo and that recovery transactions bypass them.
Scope: Documentation of one vendor’s product, read on 3 November 2026; not evidence about Binance’s custody design.

[41] Installation
Homebrew documentation | 2026
https://docs.brew.sh/Installation
Official installation guidance: default prefixes chosen so sudo is not needed after installation, the warning that Homebrew offers no security guarantees when untrusted users can write to the prefix, and an install script and .pkg with no described checksum step.
Scope: Read on 3 November 2026; documentation can change.

[42] Homebrew manpage (environment) and Library/Homebrew/env_config.rb
Homebrew | 2026
https://docs.brew.sh/Manpage
Documents HOMEBREW_VERIFY_ATTESTATIONS as applying if set, and brew verify as a provenance check that needs the GitHub CLI; the source on the main branch (github.com/Homebrew/brew) shows the setting has no default and is checked when bottles are fetched.
Scope: We read documentation and source on 3 November 2026; developer-mode behavior may differ.

[43] A peek into build provenance for Homebrew
Joe Sweeney and William Woodruff, Trail of Bits | 2024
https://blog.trailofbits.com/2024/05/14/a-peek-into-build-provenance-for-homebrew/
Describes attestations binding homebrew-core bottles to the CI workflow that built them, then early beta and not recommended for ordinary users, and notes provenance will not stop a fully malicious maintainer.
Scope: Describes the 2024 state of the feature.

[44] npm classic tokens revoked, session-based auth and CLI token management now available
GitHub Changelog | 2025
https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/
Official change notice: classic npm tokens revoked, two-hour login sessions with 2FA for publishing, and write tokens limited to 90 days.
Scope: Applies to npm publishing, not to deployment systems generally.

[45] OpenID Connect
GitHub Docs | 2026
https://docs.github.com/en/actions/concepts/security/openid-connect
Official documentation of OIDC for GitHub Actions: no stored cloud secrets, granular trust conditions, and access tokens valid for a single job.
Scope: Describes one CI platform’s mechanism; not evidence about Binance’s deployment tokens.

[46] Workspace Trust
Visual Studio Code documentation | 2026
https://code.visualstudio.com/docs/editing/workspaces/workspace-trust
Official documentation that Restricted Mode limits AI agents, the terminal, tasks, debugging, workspace settings and extensions until a folder is trusted.
Scope: Read on 3 November 2026; it gives no guidance on virtual machines.

[47] Zero Trust Architecture (NIST SP 800-207)
Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly | 2020
https://www.nist.gov/publications/zero-trust-architecture-0
Official architecture guidance that grants no implicit trust based on network location or asset ownership.
Scope: Architecture guidance, not evidence that a given control would have prevented this theft.

[48] Statement from the Press Secretary (NotPetya)
The White House | 2018
https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/
Government statement attributing NotPetya to the Russian military and describing it as the most destructive and costly cyberattack in history.
Scope: Gives no specific dollar figure, only “billions of dollars in damage”; a political statement as well as an assessment.

[49] Saddam Set Bank Heist Record: Report
Joel Roberts, CBS News | 2003
https://www.cbsnews.com/news/saddam-set-bank-heist-record-report
Report, citing The New York Times and a US Treasury official, of about $1 billion in cash removed from Iraq’s central bank on 18 March 2003.
Scope: Secondhand report from 2003; nominal dollars.

[50] 2025 Crypto Theft Reaches $3.4 Billion
Chainalysis | 2025
https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/
Annual analysis: over $3.4 billion stolen in 2025, at least $2.02 billion by North Korea, and a cumulative North Korean lower bound of $6.75 billion.
Scope: Covers January to early December 2025; lower-bound estimates.

[51] FBI links largest crypto hack ever to North Korean hackers
Sergiu Gatlan, BleepingComputer | 2022
https://www.bleepingcomputer.com/news/security/fbi-links-largest-crypto-hack-ever-to-north-korean-hackers
Report of the FBI’s attribution of the Ronin bridge theft ($620 million in Ethereum) to Lazarus and APT38, with Sky Mavis’s figures of 173,600 ETH and 25.5 million USDC stolen.
Scope: Secondhand report of an FBI statement.

[52] What actually failed in a breach?
Lugano Labs | 2026
Local evidence: ../breach-analysis/
Lugano research report on reconstructing incidents around the credentials that can still act.
Scope: A research report with an experiment design we haven’t run.