On 29 October 2026, attackers moved approximately $6.34 billion out of Binance's internet-connected trading wallets (hot wallets) in under four hours. The FBI attributes the theft to TraderTraitor, a North Korean hacking unit. As of Binance's 3 November disclosure, roughly $2.85 billion has been frozen.
The wallet-draining mechanism is crypto-specific and most enterprise defenders will never encounter it. But the months of preparation that made it possible look like a standard enterprise breach: social engineering, a compromised developer workstation, stolen credentials, and lateral movement (moving from one system to the next) across team boundaries where no single security team saw the full chain.
A fake job interview placed the first foothold
The campaign started no later than June 2026 with a tampered software download on a Wallet DevOps engineer's machine. Binance detected it, replaced the device, and rotated credentials. The response was correct. It was also incomplete: the attacker had already mapped the wallet infrastructure team.
In September, a separate software engineer was contacted through a legitimate job platform. What followed was a two-round interview, including a live video call where the interviewer shared personal photos to build trust. Near the end of the second round, the engineer was told to download a coding "assignment." The repository replaced a legitimate development tool with a malicious binary. Binance confirms it "was not detected by the endpoint security protection tools at the time".
Nothing looked wrong:
- A developer downloaded a coding assignment from a job interview.
- The binary sat where the legitimate tool had been.
- The security software on the engineer's machine had nothing to match it against.
The AI tool was the corridor between teams
This is the detail that turns a crypto theft into an enterprise story.
On 20 October, nine days before the theft, the attacker used the compromised engineer's machine and an internal AI tool to reach two other engineers on the wallet team. Binance's disclosure confirms the attacker "leveraged the compromised computer of engineer B and used an internal AI tool to gain control over" Engineers A and C. The tool is not named.
The AI tool was a shared service that connected people across roles. The attacker was already authenticated as the compromised engineer, so interacting with the tool looked like normal use. There was no exploit of the tool itself. It was functioning exactly as designed: connecting people, sharing context, enabling collaboration. That is what made it a path for moving between teams.
Through that path, the attacker found a permission token for deploying containers on one engineer's machine. On 29 October, the attacker used it to deploy a malicious container that reached Binance's internal wallet signing service. From there, the attacker initiated unauthorized transactions using valid credentials through the normal signing path.
Three gaps in one chain
The Binance breach is unusual because all three detection gaps appear in the same incident:
- Gap 1, nothing looks wrong: The malicious binary replaced a legitimate tool, the zero-day evaded the security software and the attacker removed traces of the compromise.
- Gap 2, authentication succeeds: The signing service processed the attacker's requests because they arrived through the normal path with valid credentials.
- Gap 3, movement isn't visible: The attacker crossed from a software engineer's workstation, to an internal AI tool, to Wallet DevOps credentials, to a different engineer's machine, to a container platform, to the signing service. Five hops across four functional boundaries. Each appeared in a different log.
Internal AI tools are trust boundaries nobody is watching
Most organizations adopting internal AI tools are focused on data leakage and on attackers manipulating the tool's inputs. Those are real risks. But the Binance breach shows a third: the tool itself becomes a bridge between teams, and a compromised identity on one side can walk to the other without triggering a boundary alert, because no boundary exists.
The signing service worked. The security software worked until it met a zero-day, which is what zero-days do. The credential rotation in June was the right call. Each control did its job in isolation. The gap was the chain between them, and the AI tool sitting in the middle of that chain, treated as an application rather than a trust boundary.
Detection is not broken. It is incomplete.
For a detailed walk-through of how these three detection gaps interact, including coverage mapping for identity, network, and cloud telemetry, see chapters 3 through 5 of the Mind Your Gaps in the Age of AI-Powered Attacks whitepaper.