It wasn’t that long ago that bank robbers could hold up a bank and might walk away with a few hundred thousand pounds. Maybe for a really big job that might stretch into the low millions. But with the invention of bitcoin, with its pseudonymous transactions and online nature, this has become a happy hunting ground for a new generation of criminals. These are less about shotguns and balaclavas, and more about phishing, exploits and cunning.
And nowhere is this more evident than the recent Binance attack, which affected approximately $6.34 billion (that’s right, BILLION) in digital assets. Binance says approximately $2.85 billion had been frozen or intercepted as of its initial report, so the final amount lost remains subject to reconciliation.
Binance have shared some details of how this huge attack unfolded, and in this article I’ll walk through some of the more interesting details and the lessons they offer. It’s a fascinating story covering fake software, North Korea and a made-up job application.
How it unfolded
Back in June 2026, a developer at Binance (known as Engineer A) downloaded a tampered Homebrew installation while searching for an AI coding tool. Attackers sometimes buy ads on search engines which display in the results when people search for certain things. This is known as malvertising, and is distinct from manipulating organic search rankings through search engine optimisation (SEO). Binance has not confirmed that an advert was involved in this case.
Often this can be enough to trick somebody into clicking a link and downloading malware. And to be fair, who hasn’t searched for something in a hurry and clicked the first link they found?
But Binance caught the compromise of Engineer A’s machine in June, and took steps to remediate it. They got a new machine, credentials were rotated, happy days. And to be fair, Binance claim that they detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026, so maybe this kind of thing was standard activity for them. But it is suspected that the attackers used this access to understand Binance internals, potentially including who had access to backend systems.
Fast forward to September, and another developer, known as Engineer B, was targeted by a recruiter about a role outside of Binance. As part of this, they had interviews with people and were eventually asked to complete a coding test. Slightly surprisingly, they thought it was acceptable to open this test on their Binance machine. The assignment contained malicious code that ran during setup.
Binance described it as zero-day malware, but did not say that it exploited a previously unknown software vulnerability.
The attacker was then able to use Engineer B’s machine and an internal AI tool to gain control of the machines belonging to Engineers A and C. There’s very little detail in the Binance update on what this internal AI tool was or how it worked. Once back on Engineer A’s machine, the attacker found a container deployment permission token. On 29 October, they used credentials stolen from Engineer A on Engineer C’s machine to deploy a container and launch a malicious script. The attack reached an internal wallet-signing service and initiated transactions outside the normal withdrawal process.
I’ve done a little bit of pen testing myself, and when you complete an objective it’s a great feeling. I can’t imagine the jubilation when the team responsible for this realised they’d affected $6.34 billion in assets. Presumably they were pretty chuffed.
Where the money goes
The FBI has attributed the theft to North Korea, which has denied involvement. So what does anyone do with billions in stolen crypto? Geoff White, journalist and author of The Lazarus Heist, a book about North Korean hackers, explains how thefts like this usually play out.
“The advantage of crypto for North Korea is it’s a liquid, global, speedily movable currency that is completely outside the traditional banking system and often beyond the reach of law enforcement,” he says. “What North Korea needs to do, if it’s going to advance its nuclear programme and its missile programme, is to buy in technology, to buy in resources, to buy in expertise. Those things don’t exist in North Korea, they exist in other countries.”
Once the funds have been laundered, paying someone can be as simple as handing them “a piece of paper with a crypto wallet address and a password on it. And effectively, that could be a million-dollar payment to that person. That’s how easy this is for North Korea.” The regime also wants hard currency, Geoff says, so some of the crypto will be cashed out for its operatives abroad to pay for weapons parts and expertise.
And the money may already be gone. “It’s entirely possible North Korea’s already sold on the money in this case,” he says. “It’s entirely possible they’ve handed that crypto to a laundering network in return for a share of its value.” That network would then sell the crypto off slowly, over a long period, through thousands of wallets. “It’s entirely possible North Korea has already cashed out and has already got the money.”
Why I’m astonished this was possible
Now I’m basing this only on Binance’s public reporting on this incident. And hats off to them for sharing the detail that they have, but it would be a slight understatement to say that I’m surprised by this attack chain. The use of backdoored content distributed through search results or adverts is a common technique, and North Korea, who are well known to target the crypto industry, are very well known for using recruitment lures to trick people into running malware.
Nothing hugely out of the ordinary here.
Binance performs some functions similar to a bank, though it is not necessarily regulated or structured like one. I’ve worked in banks and financial institutions in the UK, and there’s a whole range of controls and risk reduction work that makes an attack of this type very challenging. The fact that Engineer A was able to download and run untrusted and backdoored software from the internet is surprising, particularly if they are involved in operating production systems. Great that Binance caught that part of the attack, but sometimes even a small compromise can give attackers enough information for their next steps.
I think what has surprised me most is the attempt to complete a recruitment coding challenge on a work machine, when you have access to, or are in the proximity of, production services handling significant transactions. That makes me curious about the internal security culture over at Binance.
Details are limited, so I’m speculating, but also the theft of the production token from Engineer A’s machine is curious. Was this protected at all? Did it have a short life span? Did it have the minimal privileges it needed to operate? We don’t know from the public report how the token was protected, what its exact permissions were, or how long it lasted.
The developer machine dilemma
Securing developer machines is a genuine dilemma. To be successful, these folks need to be able to run a wide range of tools, be creative, and increasingly use packages or modules from public sources. If you lock these down, you slow down your people and are likely to restrict what they can produce. Leave it wide open, and attacks like this can happen.
But here’s the crux of the dilemma. These folks can have the highest levels of access to production systems, or certainly be very close to production. So for an attacker, they’re a fantastic target. And the Binance hack shows the impact of this.
The concept of Privileged Access Workstations (PAWs) is a well-established design pattern. Give people with sensitive access machines that are highly monitored and locked down, and gate access to production systems so that only these machines can touch it. This makes it especially hard for an attacker to navigate through or around them.
I’m curious about what Binance were doing and how they were set up for this attack to succeed.
The internal AI tool nobody explained
There’s a fascinating gap in the post-mortem from Binance. They mention that an internal AI tool was used by the attacker to move from Engineer B’s machine to those of Engineers A and C. They don’t explain the mechanism, so we don’t know whether the issue was specific to AI or involved other access and permissions.
Jason Rebholz, CEO of Evoke Security, sees it as a sign of where attacks are heading. “There’s a concept that I call living off the agent,” he says. “As people are connecting more and more data and tooling to their agents, it’s going to become the natural funnel point for an attacker to target, because it becomes a one-to-many type attack. I can get access to your agent and then use all of the access that you’ve granted it to accomplish my goals.”
He thinks that is a likely explanation at Binance: “The attacker got access to this AI tool. That AI tool had access to other tooling that allowed them to go and facilitate this attack further.”
AI has been a hot topic in security for the past few years, particularly around how we can prevent them from being abused in this way.
What this really brings home for me is the risk with these tools. AI adoption is flying within organisations. Vendors are falling over themselves to promote the efficiency gains available with their various AI tools. You have to wonder what checks and balances are taking place to ensure that anything deployed within a company - be it a vendor solution, or something built in-house - is secure and can’t be abused in the way that Binance experienced.
I’d be fascinated to find out more here, and hopefully Binance release more details.
Bybit: similar playbook, a year earlier
But this is far from the first time we’ve seen North Korea target crypto firms. In February 2025, about $1.5 billion was stolen from Bybit, which the FBI attributed to North Korea. The way in was not via Bybit’s own systems. A macOS workstation belonging to a developer at a supplier was compromised after the developer interacted with a malicious Docker project. The precise initial approach is not established in Sygnia’s account.
Similar to Binance, the developer had privileged access, and the attackers used a hijacked AWS session and injected malicious code into software that Bybit used for transferring funds. Sygnia reports that the attackers failed to register an additional MFA device and instead relied on an active session token. And that was that. $1.5 billion gone.
A short history of recruitment lures
And this isn’t the first time that recruitment lures have been used by North Korea. The watershed moment of North Korean financial attacks was the compromise of Bangladesh Bank, culminating in the 2016 heist. That time they abused the bank’s SWIFT connection to steal millions. Earlier intrusion activity included recruitment-related emails with malicious files sent to staff.
This pattern has evolved significantly since then, and now there’s reporting of high-quality lures relating to job offers at crypto firms, involving interviews with recruiters and CEOs, culminating in coding tests that require the victim to download and run something. Exactly what happened at Binance.
Indeed, in 2025 Binance’s co-founder publicly warned about the dangers of these techniques and how they were targeting the crypto space, according to Cointelegraph.
What your organisation can do
So if you’re worried about these types of attacks, what can you meaningfully do? A strong starting point is to map how your people can use privileged access within your organisation. That might include accessing production systems or highly sensitive data. And mapping that and understanding the controls between that objective and the outside world is vital.
Once understood, there are controls available to reduce risk, but they all come with trade-offs. I mentioned PAWs earlier, and this is a great way to make life very hard for attackers, but then admins might need two machines, and transferring data between them can be an overhead.
Restricting or banning the use of corporate IT for personal use is a sensible step to explore. In the case of Binance, I’m amazed that an admin would think it appropriate to use their work machine for a coding test for a new job. That speaks to culture, and educating people about the risks of corporate IT usage can be helpful.
Ideally, stopping people doing dangerous things, or at least reducing the blast radius should they do so, is a great way to reduce this risk.
That will undoubtedly slow people down in some cases, but the trade-off can at least be discussed and agreed.
Moreover, investing in defence in depth and creating independent, overlapping controls can hit attackers hard. That includes making it hard to move around a network, keeping identities protected and not allowing people to keep production tokens on their machines.