Binance wallet theft through compromised engineers and a standing deployment token

Binance said on October 30, 2026 that the theft from its wallets the previous day began with a DevOps engineer's compromised laptop. Its November 3 findings say a fake recruiter's coding assignment put malware on a software engineer's computer in September; on October 20 the attacker used that machine and an internal AI tool to take control of two wallet infrastructure engineers and found a container deployment permission token on one of their computers. On October 29 the attacker used that engineer's stolen credentials from a third engineer's computer to deploy a container that reached the internal wallet signing service.

Victim

Binance

Industry

Crypto and Web3

Country

Global

Intrusion began

Sep 2026

First disclosed

Oct 30, 2026

Actor

TraderTraitor, North Korea (per TRM Labs; Binance cites the FBI attributing the theft to North Korea) (Nation-state)

Initial access

Stolen credentials

Identity control that failed

Credential storage

MFA

Not disclosed

Abused identity

Human account

Records affected

Not disclosed

Disclosed cost

Not set as a figure: Binance said about USD 6.34 billion in digital assets were impacted and about USD 2.85 billion had been frozen or intercepted as of November 3, 2026, subject to reconciliation, and that it will absorb the loss.