Binance Security Breach: Social Engineering Scam Led to $6.34 Billion Hack

North Korean hackers executed a $6.34 billion crypto heist using social engineering, compromised tools, and AI to breach Binance’s systems.

Binance’s $6.34 Billion Cryptocurrency Heist

Binance revealed that North Korean hackers used deceptive recruitment processes, compromised developer tools, and an internal AI system to steal $6.34 billion in cryptocurrency. The breach, discovered in October 2026, involved a multi-stage attack combining social engineering and technical exploitation.

The Attack Methodology

The breach began in June when a DevOps engineer’s device was compromised through a fraudulent job interview. In September, another engineer, referred to as Engineer B, was targeted via a job platform by an impersonator posing as a recruiter. During the interview, the attacker prompted Engineer B to download a malicious repository containing a modified pyenv file, enabling remote command execution and communication with a controlled server.

Infiltration and Exploitation

On October 20, attackers used Engineer B’s compromised machine and an internal AI tool to infiltrate systems of Engineers A and C. Engineer A’s device held a container deployment token, which was exploited for further access. The AI tool’s exact role in the breach remains unspecified. Attackers then exploited vulnerabilities in Ethereum’s EIP-7702 protocol, allowing a smart contract to execute limited actions on a Binance hot wallet without exposing its private key.

Asset Transfers and Impact

Between 20:05 and 20:09 UTC on October 29, five hot wallets transferred 233.46 million XRP, followed by 970,500 SOL from Solana and 44.2 million OP from Optimism. Additional transfers included 18,270 BTC and 2,961.9 ETH, with the final transaction settling at 23:56 UTC. Binance’s MPC wallet architecture delayed revocation of malicious authorizations.

According to Binance’s internal investigation, the breach originated in June when a DevOps engineer’s device was compromised through a fraudulent job interview.

Response and Recovery

Binance reported that $2.85 billion in assets were frozen or intercepted by November 3, though this figure remains subject to market fluctuations. Approximately 98% of affected tokens were replenished by October 31, though this represents replacement assets, not recovered funds. The exchange restored systems, replaced hardware, and enhanced access controls. The investigation is ongoing with third-party cybersecurity firms.

Industry Implications

This incident aligns with previous North Korean-linked attacks, including a $1.5 billion theft from Bybit in February 2025, attributed to the Lazarus Group. Industry experts have raised concerns about employee device security, emphasizing stricter controls to prevent similar breaches.