Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus

What it is

StepSecurity's post of 30 October 2026 on Binance's 29 October incident, which Binance estimates affected about $6.3 billion in assets. It separates what Binance and two blockchain research firms have established from what is still unknown, then lists four earlier developer-tooling compromises with version numbers and a five-step investigation checklist. The second half describes StepSecurity's own products.

How it works

Binance's first disclosure described a possible path from a compromised DevOps engineer's laptop to a service container, where the attacker could submit unauthorized withdrawal transactions. A later update reported additional breach points, so the investigation covers more than one device. Binance says it found no evidence of a wallet private key leak.

TRM Labs reports 50 signed EIP-7702 authorizations covering consecutive nonces. A busy exchange wallet's nonce keeps changing, so the attacker prepared a range and one matched at processing time. Elliptic describes a delegation to an attacker-controlled contract that swept funds. The delegation stayed active, and at least six more sweeps followed over about three and a half hours. TRM also saw ordinary signed transfers from Binance wallets on other chains and concludes the attacker reached signing infrastructure. The page labels this a research finding, not Binance's root-cause analysis.

Preconditions / Affected

The page names these developer-machine compromises as context, not as the cause at Binance:

• Nx npm packages (August 2025): a malicious post-install script collected credentials and tried to use installed Claude and Gemini CLIs to find sensitive files.
• Nx Console 18.95.0, VS Code extension (May 2026): opening a workspace fetched a payload from an orphan commit in the official Nx repository. It was live for about 11 minutes and left a persistent Python backdoor on macOS.
• OVHcloud CLI (October 2026): binaries on five existing releases were replaced and checksums updated. The post-mortem traced the access to a malicious VS Code extension on a contributor's personal MacBook installed the previous year.
• Claude Code extension 2.1.313 (October 2026, trojanized): planted an attacker SSH key, installed persistence and tried a reverse SSH tunnel. Removing the extension did not remove the standalone backdoor artifacts.

What to do

The page's checklist:

1. Search for exact affected package and extension versions. Keep installation history, since a later update can hide earlier exposure.
2. Isolate affected devices and collect logs before removing artifacts. Revoke sessions and credentials from a clean machine.
3. Review authenticated CLI tools, SSH access, cloud roles and secret stores the developer could reach.
4. Check repository changes, package publishes, cloud API calls and sensitive service requests tied to the affected identities.
5. Check for persistence and follow-on access. Rebuild devices whose integrity cannot be established.

For a free local inventory, the page gives StepSecurity's open-source Dev Machine Guard agent (macOS, Windows, Linux), downloaded from GitHub Releases. On macOS or Linux:

chmod +x ./stepsecurity-dev-machine-guard
./stepsecurity-dev-machine-guard --enable-npm-scan --enable-python-scan --html report.html

On Windows PowerShell:

.\stepsecurity-dev-machine-guard.exe --enable-npm-scan --enable-python-scan --html report.html

Use --json for structured output. The npm and Python scans are off by default and must be enabled.

Caveats

• Binance has not named the laptop's malware, operating system or initial infection method, and has promised a technical post-mortem. The page says attributing the incident to a specific extension, package or engineer would go beyond the evidence.
• EIP-7702 explains the Ethereum delegation, not the whole incident. It needs a valid authorization from the account.
• Dashboards, policy enforcement, alerting, Secure Registry and Threat Center are enterprise features. Secure Registry only applies if package clients and CI are routed through it.