North Korean Hackers Used AI Tools, Novel Authorization in Multi-Billion Dollar Binance Heist

North Korean hackers executed a sophisticated, multi-stage attack against Binance, exploiting internal AI tools and a novel authorization mechanism to steal approximately $6.34 billion in cryptocurrency. The incident, which occurred on October 29, 2026, highlights an evolving threat landscape where state-sponsored actors leverage advanced technologies for significant financial gain.

According to Binance’s preliminary investigation report released on November 3, 2026, the attack began in June 2026 with a compromised Homebrew installer. The hackers employed social engineering tactics, including fake job recruitment, to infiltrate the exchange’s systems. A software engineer downloaded a file disguised as development tools, which contained malicious code. This malware utilized sophisticated obfuscation and evasion techniques, replacing legitimate components with malicious versions and communicating with attacker-controlled external servers.

The attackers gained access to employee devices and subsequently compromised internal AI tools. This access allowed them to obtain wallet signing permissions, bypassing normal withdrawal processes. The breach specifically exploited the Ethereum EIP-7702 authorization mechanism, a newer smart contract functionality. This allowed for the unauthorized transfer of substantial amounts of cryptocurrency, including 233.46 million XRP, approximately 970,500 SOL, and 44.2 million OP. An additional 18,270 BTC was also transferred from a hot wallet, with the last unauthorized transfer of 2,961.9 ETH reported on-chain at 23:56 UTC on October 29th.

Binance’s security team detected and blocked 57 suspected North Korean-related threats throughout 2026, indicating a sustained campaign against the exchange. The attackers’ ability to infiltrate internal systems and leverage AI tools demonstrates a significant advancement in their operational capabilities.

In response to the breach, Binance suspended withdrawals and initiated a process to freeze affected assets. As of the report’s publication, $2.85 billion had been frozen, and 98% of affected tokens were replenished by October 31st. Binance stated it may bear the financial loss from the theft and has reserved over 100% of the loss amount. The exchange has since rebuilt affected wallet systems, internal AI tools, and access control systems in a new environment, enhancing AI-based behavioral anomaly detection and risk control measures.

The incident underscores the growing sophistication of North Korean cyber operations, which increasingly target critical financial infrastructure. The exploitation of emerging technologies like AI and novel blockchain authorization mechanisms presents new attack vectors that require constant vigilance from cybersecurity professionals.

While Binance has taken significant steps to mitigate the damage and bolster its defenses, uncertainties remain regarding the full extent of compromised employee data and the precise methods used by the malware to evade detection. The investigation is ongoing, with an independent third-party cybersecurity firm set to review the incident. Binance plans to increase investment in AI-driven threat detection, endpoint protection, and development environment security, and will collaborate with industry partners to establish a security research fund for AI security in blockchain.

This preliminary report, according to Binance, is intended to share lessons learned with the industry, emphasizing the need for enhanced security protocols in the face of evolving cyber threats.

Why This Matters

The materials describe a narrow update: North Korean hackers infiltrated Binance’s systems through a sophisticated attack that began with social engineering tactics like fake job recruitment and malware disguised as development tools. The exact total value of assets stolen before countermeasures were fully effective.

Broader Context

Source materials place the factual news in this context: The article is a preliminary investigation report from Binance.