605/69 Wednesday, November 4, 2026
Binance has disclosed preliminary findings from its investigation into a cyberattack that occurred on October 29, 2026, affecting approximately USD 6.34 billion in digital assets. The attackers used multiple techniques, including fake job interviews, malicious software downloads, credential theft, compromise of employee devices, and abuse of internal AI tools as part of the attack chain. The attackers ultimately gained access to a Wallet Signing Service and transferred digital assets without authorization. Binance stated that it was able to freeze or block approximately USD 2.85 billion in assets and would cover losses suffered by affected users. The FBI attributed the activity to a threat group tracked as TraderTraitor.
The attack was reportedly prepared over several months. In June, a Wallet DevOps employee downloaded a modified Homebrew installer while searching for AI-assisted programming tools. In September, the attackers contacted another engineer through a recruitment platform and arranged an interview with a fake company before tricking the employee into downloading a technical test containing malicious commands. The malware replaced components of development tools with malicious files to execute commands and connect to attacker-controlled servers. On October 20, the attackers used the compromised device together with internal AI tools to expand access to additional employees and discovered a token with permissions to deploy containers. On October 29, the attackers used the stolen credentials and privileges to deploy a container and execute malicious scripts within systems associated with the Wallet Signing environment.
Organizations should treat developer workstations, recruitment processes, and internal AI tools as part of their attack surface. Technical assignments or code from external sources should not be opened or tested on devices that have access to critical systems. Organizations should use isolated environments for testing untrusted code, restrict deployment tokens and credentials according to the principle of least privilege, and apply appropriate expiration periods. Access granted to internal AI tools should also be limited so they cannot reach sensitive systems unnecessarily. Security teams should monitor for abnormal activity involving endpoints, developer tools, container deployments, and wallet-signing systems. Binance stated that it rebuilt the affected wallet infrastructure and AI tools, replaced related devices, revoked credentials and tokens, and introduced additional behavioral detection measures following the incident.