Binance's own report on the 2026-10-29 theft of about USD 6.34 billion: a fake recruiter's coding assignment compromised an engineer's laptop, an internal AI tool carried the attacker to two colleagues and a container-deployment token, and a deployed container reached the wallet signing service; the FBI attributes it to North Korea's TraderTraitor

Binance says the theft of about USD 6.34 billion in digital assets on 2026-10-29 was "a sophisticated, multi-stage campaign" and not a single breach or a simple phishing incident (Binance, 2026-11-03). In September 2026 a software engineer whose job-platform profile named Binance was approached by a person posing as a project director, interviewed by a purported HR representative on live video and then by a purported CEO in a chat application, and told to download an "assignment" repository onto his work computer; its setup code replaced the legitimate pyenv executable in the Homebrew installation with a malicious version, repointed the symlink and spawned a zsh shell, and the 0-day malware was not detected by endpoint protection (Binance, 2026-11-03). On 2026-10-20 the attacker used that computer and an internal AI tool to gain control over a wallet DevOps engineer and a second wallet software engineer, and found a container-deployment permission token on the first engineer's computer; on 2026-10-29 it logged onto the second engineer's computer with the stolen credentials, deployed a container and triggered a script that launched the attack on the wallet signing service (Binance, 2026-11-03). Binance reports an earlier supply-chain event in June 2026, when a wallet DevOps engineer installed a tampered Homebrew installation while searching for an AI coding tool, and says its security team blocked 57 suspected North Korea-linked cases in 2026 (Binance, 2026-11-03). The FBI says North Korea was responsible and calls the activity "TraderTraitor" (FBI, 2026-10-31). BleepingComputer notes that fake job interviews leading to malware installs are a common tactic of the North Korean campaigns known as Contagious Interview and Operation Dream Job, a comparison Binance does not make (BleepingComputer, 2026-11-03).

The transfer to other organisations is the access chain, not the loss: a developer endpoint reached through a recruiting lure, a trojaned version-manager binary that endpoint protection missed, an internal AI tool that let one compromised user act on colleagues' machines, and a deployment token that turned one workstation into code execution in a trusted pipeline.