North Korean attackers compromised Binance through a multi-stage campaign that began with a tampered Homebrew installation and a fake recruitment assignment that executed malware on an engineer’s work computer. The intruders later abused a compromised internal AI tool to reach two additional engineers, stole a container deployment token, and gained access to the wallet signing service. They used that service and malicious EIP-7702 delegations to move approximately USD 6.34 billion in digital assets, while Binance and partners froze or intercepted about USD 2.85 billion. Binance said the FBI attributed the incident to the DPRK and reported blocking 57 other suspected North Korea-linked intrusion attempts during 2026.