On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions. Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital asset industry has ever seen." He said the company takes full responsibility and that no user will bear the loss.

Why the Binance Hack Targeted Engineers, Not Systems

According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before. In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time. On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.

How the Binance Hack Unfolded on October 29

Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.

Why Binance Couldn't Stop It Faster

Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.

Who Is Behind It

Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."

Where Users Stand

Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country.

The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC’s production and distribution of bankruptcy notices for the courts.

The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services.

Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record.

The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor.

West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records.

According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky’s case, exposure was limited to appellate court data stored within the C-Track infrastructure.

Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services.

In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

site-verification-ok