Executive Summary
North Korean researchers are the leading suspect in the theft of roughly 6.3 billion dollars from Binance on 29 October, the largest crypto heist on record. Binance says it began with a compromised DevOps engineer’s laptop that let an attacker reach a service able to submit withdrawals, and later said it found further points of breach.
What stands out is what is absent. Nothing public suggests an AI agent was involved. This was a nation state using a developer, a known Ethereum upgrade and a signing path that skipped its own approval controls, which is a more common shape than the agent-driven breach at Hugging Face three months earlier.
Two of the largest security failures this year have both been traced back to cloud infrastructure, and it is tempting to read them as one story. They are not, and the difference matters for anyone deciding what to defend.
On 29 October an attacker moved roughly 6.3 billion dollars out of Binance. Some three billion has been frozen on chain. Binance has said it will cover the losses. It is the largest crypto heist in history by a wide margin.
How it actually started
Binance’s initial account points to a compromised laptop belonging to a DevOps engineer. That foothold gave an attacker a path into an internal service capable of submitting withdrawals. Co-CEO Richard Teng said on X that the attacker did not simply use one engineer’s permissions and that the attack involved more than a single click.
A later Binance update said further investigation uncovered additional points of breach beyond the laptop, without saying what they were.
The mechanism at the signing layer is the interesting part. According to Aikido’s analysis, the attacker used a known Ethereum feature, EIP-7702, to gain approval over a hot wallet in a way that bypassed Binance’s normal approval controls. There is no evidence of a private key leak, which suggests the signature came from inside Binance’s own signing infrastructure with the keys never leaving.
On the AI question, the honest answer is no
The obvious temptation is to assume this was the same kind of event as Hugging Face, where autonomous agents did the work. Nothing in the public record supports that.
Attribution points to TraderTraitor, a unit within North Korea’s Lazarus Group, per TRM Labs and Chainalysis. The FBI has linked it. Binance itself has not confirmed the attribution. What is described is human operators targeting a specific developer, which is the technique this group has used for years. The BBC’s reporting sets out the case for the attribution and its limits.
Nobody has claimed an agent framework, an autonomous loop or a model was involved. If that changes I will write about it. As of now it would be a factual error to fold this into the agent breach story.
Why the pair still belong in one briefing
Both incidents ended in the same place, which is an attacker holding credentials that let them act with authority they should never have had. Both started at the developer rather than at the perimeter. Neither defeated cryptography.
They differ in what the attacker needed. Hugging Face needed something with enormous patience and no instinct to stop. Binance needed one person and a signing path whose approvals could be routed around. The first is a new problem. The second is a very old one wearing a new protocol feature.
That has a practical consequence. If you spend this quarter hardening against autonomous agents and leave EIP-7702 style approval bypasses unexamined, you have defended against the rarer of the two. The Hugging Face breach was a control gap in a cluster. This was a control gap in a workflow that one laptop could reach.
Binance has promised a full technical post-mortem once every fact is verified. Until that lands, the account of how the laptop was compromised is a gap, and anybody describing it as solved is ahead of the evidence.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.