// AI threat desk · 4 Nov 2026
Home/SUPPLY · AI Supply Chain
AI Supply ChainMediumAISECCVSS not assigned

Binance said campaign culminated in $6.43 billion in assets

Binance said a multi-stage campaign culminated in $6.43 billion in assets being taken from the cryptocurrency exchange, involving two engineers and an internal AI tool.

· 2 min read
AI-generated image of engineers monitoring cryptocurrency exchange systems beside blurred dashboards.
AI-generated image, not a photo of the event.
Key takeaways
  • Binance said the campaign culminated in $6.43 billion in assets being taken from the exchange.
  • Binance said the campaign began with a trojanized Homebrew installer downloaded by an engineer in June 2026.
  • Binance said the attacker used unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Binance said a multi-stage campaign culminated in $6.43 billion in assets being taken from the cryptocurrency exchange. The company traced the campaign to a tampered Homebrew installation in June 2026 and said the intrusion advanced through October.

Binance said the attackers combined social engineering, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. The attack exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

The company said the incident was not a single isolated breach or simple phishing incident. It said information about one engineer’s role and related wallet-infrastructure colleagues was exposed during the attack.

On this page

Binance said a fake interview led to a malicious repository

Binance said the second stage began in September 2026 when an attacker posing as a Project Director contacted another engineer through a legitimate job-hunting platform. Near the end of the interview, the engineer was told to download an assignment containing a malicious code repository onto a work computer.

The repository’s malicious code executed during setup and initiated unauthorized activities, the company said. Binance said the first stage had involved Engineer A, a Wallet DevOps engineer who downloaded a trojanized Homebrew installer while searching for an artificial intelligence tool on a search engine in June 2026.

Binance said an internal AI tool was abused in the intrusion

The intrusion moved to another stage on Oct 20, 2026, when the attacker used Engineer B’s compromised computer and abused an internal AI tool to gain control over Engineer A and another wallet software engineer, Binance said.

Binance rebuilt wallet and AI systems after the attack

Binance said it reconstructed the affected wallet system in a new environment and rebuilt the internal AI tool and access controls. It also said it enhanced AI-based behavioral anomaly detection and strengthened wallet-service risk controls.

Binance said it worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets. It also said the attack entry points had been closed and systems touched in the attack path had been rebuilt or replaced.

The company said it was increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioral anomaly monitoring. Binance also estimated that it had foiled 57 suspected North Korea-linked cyber threat cases since the start of the year.

FAQ

What happened to Binance?

Binance said a multi-stage campaign culminated in $6.43 billion in assets being taken from the exchange.

How did the Binance campaign start?

Binance said the campaign began with a supply-chain attack against an engineer who downloaded a trojanized Homebrew installer while searching for an AI tool in June 2026.

Did the attacker use Binance’s AI tools?

Binance said the attacker abused an internal AI tool on Oct 20, 2026, to gain control over Engineer A and another Wallet Software Engineer.

How did the attacker move Binance assets?

Binance said the attacker used unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

What did Binance do after the campaign?

Binance said it rebuilt the affected wallet system, internal AI tool and access controls, and closed entry points used in the attack.

Sources

  1. Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft, The Hacker News
How we checked this story
ClaimSourceStatus
Binance said the theft of $6.43 billion in assets was the culmination of a sophisticated, multi-stage campaign.Binance, via The Hacker NewsAttributed
Binance said the campaign involved a tampered Homebrew installation and recruitment-themed social engineering targeting two engineers.Binance, via The Hacker NewsAttributed
Binance said the incident was not a single isolated breach or simple phishing incident.Binance, via The Hacker NewsAttributed
Binance traced the campaign’s start to a supply-chain attack against an engineer who downloaded a trojanized Homebrew installer in June 2026.Binance, via The Hacker NewsAttributed
Binance said information about Engineer A’s role and related wallet-infrastructure colleagues was exposed to the hacker.Binance, via The Hacker NewsAttributed
Binance said the second part of the attack occurred in September 2026 through a fake Project Director persona on a legitimate job-hunting platform.Binance, via The Hacker NewsAttributed
Binance said Engineer B was instructed near the end of an interview to download a malicious assignment repository onto a work computer.Binance, via The Hacker NewsAttributed
Binance said the repository’s malicious code executed during setup and initiated unauthorized activities.Binance, via The Hacker NewsAttributed
Binance said the attacker logged onto Engineer C’s computer on October 29, deployed a container and triggered a malicious script.Binance, via The Hacker NewsAttributed
Binance said the attack exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.Binance, via The Hacker NewsAttributed
Binance said it reconstructed the affected wallet system in a new environment and rebuilt the internal AI tool and access controls.Binance, via The Hacker NewsAttributed
Binance said it enhanced AI-based behavioral anomaly detection and strengthened wallet-service risk controls.Binance, via The Hacker NewsAttributed
Binance said it worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.Binance, via The Hacker NewsAttributed
Binance said the attack entry points were closed and systems touched in the attack path were rebuilt or replaced.Binance, via The Hacker NewsAttributed
Binance said it was increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioral anomaly monitoring.Binance, via The Hacker NewsAttributed
Binance estimated that it had foiled 57 suspected North Korea-linked cyber threat cases since the start of the year.Binance, via The Hacker NewsAttributed

Could not verify

  • Whether the stolen assets were recovered is not established
  • Whether the attackers were North Korea-linked is not established
  • How many Binance users or accounts were affected is not established
  • Whether the internal AI tool had a security flaw is not established
See all in AI Supply Chain →
Explore with AI
ChatGPT
Claude
Perplexity
Grok