Binance published its initial report on the largest crypto heist in history: on October 29, 2026, approximately $6.34 billion in assets were drained from the exchange's hot wallets, ranging from Bitcoin and Ethereum to XRP, SOL, and OP across ten blockchains. According to the company, the preparation took months: a trojanized Homebrew installer found by the victim via a search engine, fake interviews with a 'test assignment,' and, at an intermediate stage, the use of Binance's internal AI tool to compromise engineers' machines. The final strike did not target private keys but rather internal services and delegated permissions, a lesson that applies to both agent-based infrastructure and anyone working on a computer.

image
image

What Happened

According to Binance's initial report, on October 29, 2026, approximately $6.34 billion in assets were drained from the exchange's hot wallets: 18,270 BTC, 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, 200,630 ETH, and other tokens across ten blockchains, with the drain taking about twenty minutes. The preparation stretched over months. In June 2026, Engineer A downloaded a trojanized Homebrew installer via a search engine. In September, Engineer B went through fake interviews on a legitimate recruiting platform, and a 'test assignment' used a zero-day vulnerability to quietly replace a system component in pyenv, which antivirus software did not detect. On October 20, attackers used the infected computer and Binance's internal AI tool to compromise the machines of Engineers A and C and found a container deployment token. On October 29, they deployed their own container, gained access to the internal transaction signing service, and on Ethereum sent 50 signed EIP-7702 delegation authorizations to drain funds, bypassing the standard withdrawal infrastructure. By the time the report was published, available data indicates that approximately $2.8–3 billion of the stolen funds had been frozen.

Context

The attack targeted not cryptography, but trust and system design. The keys were not stolen in a pure sense: instead, the EIP-7702 delegation mechanism from the account abstraction family was used on Ethereum, where signed authorizations grant another address the right to execute operations on behalf of a wallet. Thus, the object of the attack was the design of delegated permissions themselves. Trust was exploited at every step: the Homebrew installer was found via a search engine, the interviews took place on a legitimate recruiting platform, and the replacement of pyenv, a trusted developer environment component, remained invisible to signature-based protection. This is a supply-chain vector through developer tools, amplified by social engineering. A separate layer of risk is created by internal AI tools and MCP-like integrations: an agent with broad permissions becomes a convenient route for lateral movement to critical systems, and complex delegation mechanisms make revoking permissions difficult. In its analysis, Chainalysis tracks a North Korean trail in the fund outflow, although final conclusions will likely appear with Binance's full technical report.

Why This Matters for the Industry

For the industry, this is a signal that the primary risk for exchanges has shifted from private key leaks to the compromise of internal signing services, deployment tokens, and AI tools. Teams with internal AI agents should now inventory their agents and MCP integrations with their actual permissions, review and narrow deployment token scopes, isolate AI tools from signing and withdrawal systems, and configure tool call auditing and alerts for anomalous actions. Wallet products should re-evaluate how quickly and through what interface a user can revoke a delegation. A wave of post-mortems and stricter practices is expected to follow the incident: security reviews of agent systems before production deployment may become a standard gate practice, guides on isolating MCP services and monitoring anomalous EIP-7702 authorizations will appear, and agent security will evolve from a separate feature into a product category with a ready ROI case and a line item in the budget. Within a couple of years, a design shift is likely: least-privilege by default for agent platforms, formal perimeters and audits of AI tool permissions in critical systems, benchmarks and methodologies for agent security assessment, and possible protocol restrictions on mass delegation authorizations.

Why This Matters for Users

The lessons apply to any work computer, not just crypto infrastructure. Do not install 'popular' AI tools via random links from search results: in this incident, the attack was built in part on a trojanized Homebrew installer found exactly this way. Do not download or open 'test assignments' on a work machine, even if the interviews looked convincing and took place on a legitimate recruiting platform: the pyenv replacement passed through antivirus via a zero-day. Those who use agent tools and connect them to work systems should treat such agents as high-privilege code capable of becoming a bridge for an attacker. If you hold assets on exchanges, assess the risk soberly: even the largest exchange can lose billions of dollars in minutes, and freezing funds is not yet a return. Ethereum delegation holders can review active EIP-7702 authorizations and ensure their wallet allows for quick permission revocation.

What Is Still Unknown / Limitations

The initial report contains little specific detail. It has not been disclosed exactly which internal AI tool was used, whether it was an autonomous LLM agent, what permissions it had, or what its call logs show; it has not been established whether prompt injection was applied against the tool. Therefore, the thesis of 'actual AI involvement' cannot be confirmed or reproduced with current data—it is more accurate to speak of the use of an internal AI tool as a bridge during lateral movement. The link to North Korean actors is based on Chainalysis tracing and requires confirmation in Binance's full technical report, which has not yet been released. The amounts in publications vary slightly: the initial report cites ~$6.34 billion, The Hacker News headline mentions $6.43 billion, and the estimate of frozen funds is approximate.

Sources

Author

Look at AI, editorial team