Binance disclosed a record $6.43 billion theft resulting from a multi-stage campaign that combined a trojanized Homebrew installer, recruitment social engineering, and internal AI tool abuse to breach wallet infrastructure.
As the company explained, this was not a simple isolated breach, but a series of planned actions that targeted its employees.
How it all started in June
It all started in June 2026, when an engineer on the wallet systems management team, known as “Engineer A,” downloaded a tool that was infected with a dangerous program.
Although Binance detected the incident and immediately changed the digital access keys as a precaution, information about the role of the employee in question and his colleagues on the infrastructure team was exposed to the perpetrators.
The fake interview trap
In September 2026, the attack continued, targeting another employee, “Engineer B.” Unknown individuals approached the engineer through a job search platform, posing as the project manager.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Attack on cPGuard: What to do if you use OPSSHIELD software
↗
This was followed by an interview with a supposed HR manager and a second interview with someone claiming to be the CEO. At the end of the process, Engineer B was asked to download a test job in code form to his company computer, which contained malicious code that gave the perpetrators access to the device.
The final phase and the theft
On October 20, 2026, the perpetrators used Engineer B's compromised computer and exploited an internal artificial intelligence tool to gain control over Engineer A and a third colleague, "Engineer C."
Between October 29th and 29th, the perpetrators logged into Engineer C’s computer, used stolen credentials from Engineer A, and ran a malicious program. In doing so, they exploited access to an internal transaction authorization service and made transfers outside of the normal process.
The company's measures
By November 3, Binance had rebuilt the affected wallet system, updated its AI tools and access control systems, and replaced affected devices. The company had revoked old digital keys, conducted extensive security audits, improved detection of unusual behavior, and was working with authorities and security experts to track and freeze assets.
At the same time, Binance estimates that it has prevented 57 suspected cases of cyberattacks linked to North Korea since the beginning of the year.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
