Overview
- The theft, which occurred on Oct. 29, 2026, removed roughly $6.3 billion in crypto from five Binance wallets after attackers used stolen credentials and a malicious script to subvert the service that signs transactions.
- Investigators say the intruders built access over months by using a modified Homebrew package and a fake job interview to trick engineers into installing undetected 0‑day malware.
- On Oct. 20 the attackers abused a Binance internal AI tool to escalate access to other engineers’ systems and then on Oct. 29 used those credentials to execute the withdrawals.
- Binance immediately suspended withdrawals, froze about $2.85 billion on‑chain, executed a blockchain revocation to cancel malicious permissions, rebuilt compromised systems, rotated credentials and commissioned independent audits.
- The company says it has replenished about 98% of affected tokens from reserves that exceed the loss, has begun staged re‑enabling of withdrawals on Ethereum and Solana, and faces an FBI attribution to North Korea that Pyongyang denies.