Binance heist forensics detail fake job interviews, compromised AI tools and $6.34B drain

The theft of $6.34 billion from Binance in late October 2026 was not the work of a single infected laptop, according to a detailed forensic account published on dev.to. The post, which draws on what it describes as Binance's official incident autopsy alongside analysis from TRM Labs, Chainalysis and the FBI, attributes the operation to North Korea's TraderTraitor unit, better known as Lazarus Group, and traces it back five months before any money moved.

The version that circulated first — a compromised engineer machine, an Ethereum transaction using the EIP-7702 delegation feature, and a rapid burst of roughly fifty transactions from the hot wallet known as Binance 14 — captured only the final act. The fuller record describes social engineering, poisoned developer tooling and a pivot through Binance's own internal AI systems, ending in a synchronized drain across ten blockchain networks.

A poisoned installer opened the door

In June 2026, according to the account, a Binance wallet infrastructure engineer tried to install a popular third-party AI coding tool and pulled a tampered installer from an untrusted package channel. Binance's security operations center detected the payload, isolated the machine and wiped it, but not before the malware exfiltrated internal directory data: developer usernames, reporting lines and fingerprints of the technology stack. That gave the attackers a map of who worked on the wallet-signing pipelines.

The fake recruitment loop

Three months later, in September, operatives posing as recruiters from a fabricated startup contacted a senior DevOps and infrastructure engineer through a professional networking platform. The ruse involved plausible web domains and corporate profiles, multiple live video interviews about distributed systems, and weeks of rapport-building. The decisive moment was the technical assessment: a GitHub repository that the engineer downloaded and executed directly on a corporate laptop. Its build scripts carried obfuscated malware that ran in memory, slipped past commercial endpoint detection, and established persistent root-level access on an authenticated workstation.

A pivot through Binance's own AI assistant

On October 20, the account says, the intruders moved laterally without noisy network scanning. Binance engineers used a containerized internal AI developer assistant to query architecture documentation and APIs; the attackers took over that integration to map the microservice topology around automated wallet-signing containers. They harvested short-lived Kubernetes service tokens and SSH credentials from local developer caches, then crossed VPC peering boundaries using valid credentials until they reached the cluster that dispatches hot-wallet transactions.

The account stresses one point in particular: the private keys were never cracked. They stayed inside hardware security modules and MPC nodes throughout. What the attackers compromised was the software service authorized to tell those keys what to sign.

Twenty minutes, ten chains

On October 29 the group executed a coordinated drain across Ethereum, BNB Smart Chain, Solana, XRP Ledger, Sui, Base, Polygon, TRON, Arbitrum and Optimism. On Ethereum this surfaced as the EIP-7702 delegation and the burst of transactions from Binance 14 that analysts first focused on. Around $6.34 billion left Binance custody in roughly 20 to 30 minutes, routed into aggregation contracts controlled by the attackers.

Freezes, a backstop and a rebuild

Anomaly detection prompted Binance to sever its signing services and halt outbound bridges. Working with law enforcement and blockchain intelligence teams, issuers blacklisted funds in flight: Tether froze $1.567 billion in USDT, Circle more than $800 million in USDC, and Ripple, BitGo and validators a further $229 million, about $2.85 billion immobilized before it could reach mixers or privacy pools. Binance pledged the full $6.34 billion from corporate reserves, meaning no customer losses, and the account says 98 percent of the drained assets were re-acquired within six days. The exchange's proof-of-reserves program expanded from 10 to 44 assets using zk-SNARKs, and withdrawals returned through nine staged rollouts.

Why it matters

The incident reframes several assumptions. First, developer trust decisions — running an interview repository on a corporate laptop, installing a tool from an unofficial channel — now sit in the same risk class as key custody. Second, AI tooling appears twice in the kill chain: as a supply-chain entry point through tampered packages, and as an escalation path, since an internal assistant that knows your architecture, paired with a laptop cache holding live Kubernetes tokens, hands over both the map and the door keys. Third, keeping private keys in an HSM is not a security boundary if the signing orchestration layer above them can be taken over. Finally, the freezes that saved $2.85 billion depended on centralized issuers acting after funds had already left the network — useful triage, as the account itself notes, but not a substitute for architecture that stops a drain earlier. Readers should also treat this as one published narrative; the primary disclosures it cites, from Binance, TRM Labs, Chainalysis and the FBI, remain the authoritative record for the specifics.