On 29 October 2026, Binance suffered what it calls a serious and highly sophisticated security incident. According to Binance, approximately USD 6.34 billion in digital assets were impacted and about USD 2.85 billion was frozen or intercepted. Binance says it will absorb the loss and that 98 percent of the impacted token assets had been replenished as of 31 October 2026.
Binance describes a multi-stage campaign rather than a simple phishing incident. It began with a fake recruitment interview in which an engineer was told to download an “assignment” onto his work computer. The zero-day malware inside was not detected by endpoint security tools at the time.
The attacker then used an internal AI tool to gain control over two other engineers and found a container deployment permission token. On 29 October, the attacker used stolen credentials to launch the attack through the wallet signing service and Ethereum’s EIP-7702 authorization mechanism, which complicated containment.
Binance says it detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. It adds that the latest information released by the FBI indicates North Korea is responsible.
For you, the lesson is clear. Treat unsolicited job offers and downloads on work devices as real attack routes, and secure your developer environments and internal AI tools.
Read x.com article for more information.
