The first Binance security report on October 29’s record-breaking heist is out, and it reads less like a post-mortem than a thriller script: a trojanized installer planted in a search ad, a fake job interview with a fictitious CEO, and – the detail that will keep every CISO awake tonight – an internal AI tool turned against the company’s own engineers. Binance put the loss at roughly $6.34 billion, which multiple outlets round to $6.3 billion and The Hacker News pins at $6.43 billion. Either way, potentially the largest financial heist on record.
The Attack Chain, Stage by Stage
According to the report, disclosed November 3:
- June 2026 – A wallet-operations engineer downloaded a tampered Homebrew installer while trying to install a popular AI coding tool. The malicious build sat in an advertisement, so it outranked the legitimate package in search results. Search ads: now a supply-chain attack vector.
- September 2026 – A second engineer was approached on a job-search platform for a role at a company that did not exist. In a second virtual interview – complete with a video call featuring a fictitious CEO – he was told to download a “coding assignment” containing malware onto his work machine.
- October 20 – Using the second engineer’s compromised machine, the attacker abused an internal AI tool to take over two more wallet engineers’ systems.
- October 29 – Stolen credentials and malicious code hit Binance’s internal wallet signing service, initiating transactions outside the normal withdrawal path and draining the funds.
FBI Points the Finger at North Korea
On October 31, the FBI attributed the theft of more than $6 billion from Binance to the Democratic People’s Republic of Korea and an outfit known as TraderTraitor – the same actors behind the $1.5 billion Bybit hack. Binance suspended withdrawals immediately, set aside more than 100% of what it needed to cover customer losses, and said it had replenished 98% of impacted token assets by October 31.
Why This Matters Beyond Binance
The New York Times framed the incident as the start of a riskier era of AI-assisted crypto theft, and the playbook explains why: none of the four stages needed an exotic zero-day. It needed search ads, social engineering and a video call with a CEO who never existed. Binance’s report is labeled initial findings, with an independent review pending – but the industry takeaway is already clear. The next wave of crypto exploits will arrive wearing a job offer, not a exploit kit.
