al-ice.ai

Search, Install, Own: A Trojanized Installer for an AI Coding Tool Opened the 6.34 Billion Dollar Binance Heist

Agent & Supply Chain Security by al-ice.ai Editorial

On 3 November 2026, Binance published its initial findings on the 29 October 2026 theft of approximately USD 6.34 billion in digital assets — and the AI angle is not decorative. The report traces the campaign to June 2026, when a Wallet DevOps engineer the company calls Engineer A downloaded a tampered Homebrew installer in order to install a popular AI coding tool after searching for it on a search engine. Binance says its security team detected the anomaly, replaced the device, and rotated all related credentials — but the attacker had already learned Engineer A’s role and the makeup of the wallet infrastructure team. Four months later, a fake job interview compromised a second engineer, and on 20 October the attacker used a compromised internal AI tool as the springboard from the second engineer’s machine to the first engineer’s credentials and into the wallet signing service. The AI coding tool was the way in; the internal AI tool was the way across.

A four-month runway: June download, September interview, October pivot

Binance’s timeline reads like a supply-chain security syllabus. The June supply-chain attack started at a search engine: Engineer A searched for an AI coding tool and fetched what looked like Homebrew, but was trojanized. Detection and credential rotation followed, yet the exposure of team structure survived — the classic residual of a handled-but-leaked intrusion. In September 2026, the actor contacted Engineer B through a legitimate job-hunting platform posing as a Project Director, ran a live first-round video interview through a supposed HR representative who shared a social media account with personal photos and videos to build credibility, then moved the second round to a social chat app where a fake CEO’s process ended with Engineer B downloading an “assignment” code repository onto his work computer. The malware executed during setup, substituted a legitimate development-tool component with a poisoned version — the report details a pyenv binary swap (staging a malicious pyenv_, deleting the valid pyenv, renaming the malicious file into its place, then spawning zsh) — opened a channel to an attacker-controlled server, and scrubbed forensic artifacts. Binance notes the malware was a 0-day undetected by endpoint protection at the time. Then came the AI-tool pivot: on 20 October the attacker leveraged Engineer B’s compromised computer and abused an internal AI tool to gain control over Engineer A and a third engineer, Software Engineer C, discovering that Engineer A held a container deployment permission token. Between 17:15 and 19:56 on 29 October, the attacker logged onto Engineer C’s machine, spent Engineer A’s stolen credentials, deployed a container, and triggered the malicious script that reached the signing service.

The last mile was crypto-native, and it fought back

What followed is worth summarizing because it shows where even a prepared response loses time. The attacker used the signing service to initiate transactions outside normal withdrawals — 233.46 million XRP in four minutes (20:05–20:09 UTC), roughly 970,500 SOL and 44.2 million OP, then 18,270 BTC — before exploiting Ethereum’s EIP-7702 authorization mechanism to delegate partial execution rights over a hot wallet to an attacker-controlled contract, submitting 50 signing transactions to manipulate the account nonce and entrench malicious delegation. Because the hot wallet used multi-party computation with no single private key, revocation required a bespoke procedure, and suspending withdrawals could not stop on-chain authorizations operating independently of Binance infrastructure. The final unauthorized transfer of 2,961.9 ETH finalized at 23:56 UTC; at 00:10 UTC on 30 October Binance cleared the delegation with a zero-address authorization. Containment plus partner coordination froze about USD 2.85 billion; Binance says it set aside more than 100 percent of the loss, had replenished 98 percent of impacted token assets by 31 October, and cites the FBI’s indication that North Korea is responsible, consistent with the 57 suspected North-Korea-linked cases its team says it blocked across 2026.

What defenders should take from the report

Three lessons generalize beyond exchanges. First, the developer-environment download is now a first-stage access broker target of choice: a trojanized installer for a coveted AI coding tool, a poisoned interview assignment that swaps a toolchain binary — both initial vectors in this campaign lived in the gap between “developer fetched a tool” and “security verified the tool.” That is the same gap behind the fake AI SDK npm packages carrying Windows RATs and the testmetest repos armed to execute through agent hooks. Second, internal AI tools are lateral-movement infrastructure: whatever the tool’s legitimate function, its access to engineers’ machines and context made it the bridge between two separately compromised endpoints. Binance’s response — rebuilding the internal AI tool and its access controls in a new environment, alongside the wallet system — treats it as compromised infrastructure rather than a bystander. Third, handled does not mean harmless: the June incident was detected and remediated, yet the organizational intelligence it leaked shaped everything after. Post-incident rotation without reassessing what the attacker learned leaves the runway intact.

What to do

  • Pin and verify developer-tool installers. Distribute Homebrew, language managers, and AI coding assistants from internal mirrors with hash or signature checks; treat search-engine-first installs on engineering machines as a compromise indicator worth hunting.
  • Inventory internal AI tools as privileged access paths. Map which agent platforms, coding assistants, and internal bots can reach engineer endpoints or credentials, and apply the same session, token-scoping, and anomaly-detection controls you apply to VPNs and jump hosts.
  • Quarantine interview artifacts. Code assignments, take-home repos, and “setup this project” instructions should execute in isolated, non-corporate environments — never on a work machine with production-adjacent access.
  • Assume handled intrusions leaked org charts. After any endpoint compromise, rotate not only credentials but the assumptions: review who the affected employee works with, what tokens live on their machines, and which colleagues become the next lure targets.

We verified this briefing read-first-hand against the full Binance official report “Binance Security Incident: Initial Findings and Response Update” (initial findings dated 3 November 2026: June tampered-Homebrew AI-coding-tool download, September fake-interview assignment with pyenv component swap, 20 October internal-AI-tool pivot, 29 October signing-service abuse with EIP-7702 and MPC revocation detail, 6.34 billion dollar impact with 2.85 billion frozen, FBI North Korea indication, and the remediation program including the rebuilt AI tool and the planned security research fund with AI companies) and the full Hacker News report on the disclosure (three-engineer chain, June detection with residual exposure, and the Chainalysis note on similar interview schemes). The SecurityWeek, CNBC, Wired, and Fortune pieces are carried by URL and attribution only. We accessed no Binance system, downloaded no installer or repository, and contacted no one. Brave Search was used for discovery only.

Sources: