On October 29, 2026, Binance was hacked. $6.3 billion was drained in 20 minutes.
That is by far the largest crypto theft ever recorded as of the date of this post (30th October 2026). The previous record was Bybit, which lost $1.5 billion in February 2025 to hackers from North Korea. As of the time I’m writing this post, Binance points to North Korea again, although that is still preliminary.
According to Binance, the hack actually started with a compromised laptop. That laptop gave the attacker access to an internal service, and from there they were able to submit withdrawals as if they were legitimate. Out of the $6.3 billion, though, about $3 billion has been frozen by Tether and Circle. Some folks argue about whether it’s good for stablecoin issuers to have the right to freeze assets. It’s the usual debate about balancing decentralisation, censorship resistance and fraud prevention. You know, funds that are stolen or acquired fraudulently should be stopped. Binance has suspended deposits and withdrawals and says it will cover all user losses, and I really hope they do.
To be honest, Binance is just the latest one. Some folks have been calling this October “Red October” because the number of cyber attacks happening is wild. There is a consensus that these cyber attacks are being enabled by frontier LLMs. That’s quite hard to do, though, because frontier LLMs have guardrails and will stop when you start probing cybersecurity stuff, but attackers are finding smarter ways to fool the LLMs. Anyway, 2026 has been a rough year. Crazy shit has happened, like Iranian hackers wiping tens of thousands of employee devices at Stryker, a medical technology company; ShinyHunters stealing data on over 30 million students and staff from Canvas, the learning platform a lot of universities run on, and the company ending up paying the ransom; and attackers tricking Meta’s AI chatbot into sending out Instagram password reset codes. It’s been crazy. The FBI also declared a “major cyber incident” after one of its own surveillance systems was compromised. Even security tools got hit. Trivy, Bitwarden and Checkmarx were compromised, and the damage spread to the companies that depend on them.
I read all of this the way most people do, from a safe distance.
Now I’m gonna tell you about my own experience with cyber attacks and why I think this is such a crucial time. Before I start, I will leave a piece of advice that Binance’s CZ tweeted:
DO NOT CLICK LINKS IN EMAILS. DO NOT DOWNLOAD ATTACHMENTS, EVEN FROM PEOPLE YOU TRUST. THEY MIGHT UNKNOWINGLY HAVE A VIRUS ON THEIR COMPUTER.
The contagious interview
On 28th October, a day before the Binance hack, some guy DMs me on Telegram. They’re like, “Amschel, we’re really impressed by your experience. We are building a crypto platform and looking for a senior engineer. It’s about tokenisation. Mind having a call?” I say okay, let’s do it in 10 minutes. They send the link, we join the call, and the guy explains the project and asks a bunch of questions. To be honest, I was expecting that their real intention was to get me to run some code so they could infect me with malware, because it happened to my friends a few months ago and I spent entire nights helping them clean up their computers. Anyway, I wanted to see what the malware was like. After all the talking, the guy says, “Share your screen and run this code, and I’ll explain what it does.” The project was a real estate platform called RoyalCity, with 3D property tours, a React front end and a Node server. It also had a lot of crypto wallet libraries, which in 2026 is not unusual.
You download the project, type npm install, then npm start, and you get on with it. That’s what I was supposed to do. But of course, I didn’t run it. I knew the malware was somewhere. Usually they keep it in files named vite.config.js or postcss.config.js, but there wasn’t any malicious code there, so I wondered where it was.
I asked Claude to go through the code and told it specifically not to execute anything. As expected, the project wasn’t testing my skills. It was testing whether I would run a stranger’s code without reading it.
How the attack works
So there were two traps in the project, which I will explain below.
The first one is in the server. When you type npm start, the app loads its server, and one of the files runs a function straight away, before you have even clicked anything.
That function reads three values from a settings file. They are labelled like normal config, something like “Runtime config API key”, and they are written in base64, which is basically a simple encoding that makes text look like random characters. Once you decode them, you get a web address on a site called hamilix[.]com and a password that gets sent along with the request.
Your computer then contacts that address, and the attacker’s server replies with an error. The app passes that error to a function called errorHandler, and errorHandler takes the error message and runs it as code. The error message is the malware.
So in short, you run the app, which is a Node.js server. It calls a function as soon as the server starts, and that function contacts a remote server with some payload that was stored in a settings file as base64 strings.
The function is called errorHandler and it sits in a folder called validator, so it looks like the most boring part of the codebase and nobody would bother opening it. The key line is new Function('require', error)(require), which basically means: take whatever text came back from the internet and run it as a program, with full access to your computer. The code is just a malware loader. You run it, and their server sends malware they control to your computer.
Since the attacker controls what comes back, they can send anything they want. It could steal the passwords saved in your browser, empty your crypto wallets, or just sit there quietly. They can also change it whenever they want without touching a single line of the project you downloaded. So the code you read today can be harmless and still be dangerous tomorrow. That’s what’s crazy about it.
The second trap is in the editor. Most developers use VS Code, and the project came with a hidden VS Code settings file. On a Mac or Linux machine, this file changes what happens when you open a terminal inside the editor. Instead of just opening a terminal, it quietly downloads a script from a second site, elixirfoundry[.]xyz, and runs it in the background.
The first line of the file is padded with hundreds of blank spaces, so the dangerous lines sit way off to the right where you would never scroll. The file also has a setting that hides the .vscode folder from the editor’s file list. So basically, the file hides the folder it lives in. Wild.
So it doesn’t matter which computer you are on. On Windows, running npm start gets you. On a Mac or Linux, just opening a terminal is enough.
How it spreads
Now, once the attacker has your computer, they have everything on it, and if you’re a developer, that includes your GitHub. Most of us stay logged in to GitHub on our machines, with saved keys and tokens so we don’t have to type a password every time we push code.
Security researchers have reported that this campaign now uses that access to spread itself. The attacker pushes the same malware loader into the victim’s own repos, usually hidden inside a normal-looking commit, the same way it was hidden in the project they sent me.
Now think about who uses those repos. Your colleagues, your clients, the folks you work with on open source. They trust you, so when they pull your latest changes and run the project, they get the malware too. Their machines get infected, their GitHub accounts get used the same way, and it moves on to their collaborators.
It’s basically a virus that travels through trust. Nobody in the chain is being careless. They are pulling code from someone they know and work with, which is exactly what they are supposed to do. One person accepting a fake job interview can end up infecting a whole team, a company, or an open-source project that thousands of people depend on. That’s why it’s so hard to contain.
This isn’t new
Researchers actually have a name for this: Contagious Interview. Microsoft and others link it to North Korean state hackers, and it has been going on since at least late 2022. They pretend to be recruiters for crypto and AI companies, send developers a coding test, and wait for someone to run it. Researchers have found hundreds of projects like the one they sent me.
Now back to Binance. We don’t know how that one laptop got compromised, and I’m not gonna pretend we do. But the pattern is worth paying attention to. The biggest crypto heist in history started with one person’s computer.
Why it feels like we’re living in a cyber dystopia
First, these attacks target completely normal stuff. Looking for a job, opening your work laptop, running code a colleague sent you, asking a chatbot for help with your account. None of that feels risky, and that’s exactly why it works.
Second, the scale. This isn’t one guy in a hoodie. It’s usually a whole state with a budget, running fake companies, fake recruiters and polished projects, with malware they can swap out every day. Stolen crypto reportedly helps fund that network, so in a small way, a developer’s job application has become part of a much bigger fight.
Third, trust is the actual weak point. Every one of these attacks works by borrowing trust: a friendly recruiter, a security tool’s reputation, an engineer’s access, a colleague’s repo. The more connected everything gets, the more one bit of misplaced trust is worth.
It’s grim, I can’t lie. But the fixes, at least for individuals, are quite simple.
How to protect yourself
If you’re a developer or looking for a job in tech, read before you run. Don’t install or start a project from someone you don’t know until you, or a tool you trust, have gone through it. Check the package.json file, anything inside a .vscode folder, and any config file with long strings of random-looking characters. Stuff like new Function, eval, child_process, atob and curl piped into sh isn’t always malicious, but in a take-home test it deserves a very hard look. I think telling Claude to check the repo before you run it is a good first step. Don’t even clone the repository to your machine. If there is a way to check it while it’s still in the browser, using GPT-6 Astra’s computer skill or Claude in Chrome, then that works.
Run test projects somewhere you can throw away, like a virtual machine, a container or a cloud dev environment. Never on the same laptop that has your crypto wallet, your password manager and your work accounts.
Verify the recruiter outside the chat. Go to the company’s real website and contact them there, and check that the recruiter actually shows up on the company’s own pages, not just on LinkedIn. A real company rarely needs you to run their code on your personal machine before a first call.
To protect the folks you work with, use GitHub tokens that expire and only have access to what they need, turn on two-factor authentication, and require reviews before anything gets merged into shared repos. If a commit shows up in your repo that you don’t remember making, treat it as an emergency, not a mystery.
If you’re not a developer, the basics still go a long way. Turn on two-factor authentication everywhere, ideally with an authenticator app and not SMS. Use a password manager instead of saving passwords in your browser, because browser passwords are the first thing this kind of malware grabs. Keep any serious crypto on a hardware wallet. And slow down whenever something is both friendly and urgent. “Quick task, just run this” and “your account is locked, click here” are the same trick.
If you’ve already run something like this, treat the computer as compromised. From a different device, change your important passwords and log out of all active sessions, especially email, GitHub, cloud accounts and banking. Revoke your GitHub tokens and SSH keys, and check your repos for commits you didn’t make. Move any crypto to a new wallet created on a clean device, then wipe and reinstall the machine. And tell your collaborators so they can check their own machines before it spreads any further.
So, what now
I deleted the project and kept the details for this post. The two malicious domains were hamilix[.]com and elixirfoundry[.]xyz. I wrote them with brackets so nobody clicks them by accident.
What stays with me is not how sophisticated it was. It’s how ordinary it was. A friendly message, a normal request and a project that looked like a hundred others. The only thing between me and a very bad month was deciding to read the code before running it.
When one laptop can lose $6.3 billion, that habit is worth a lot more than it sounds.
Sources
NBC News, “Binance targeted in $6.3 billion crypto heist, the largest ever”, 29 October 2026. nbcnews.com/business/markets/binance-hack-tether-circle-stablecoins-rcna606445
Axios, “Binance halts trading after biggest-ever crypto hack”, 29 October 2026. axios.com/2026/10/29/binance-cyberattack-crypto-heist
CNBC, “Binance hack rattles crypto markets”, 30 October 2026. cnbc.com/2026/10/30/bitcoin-ether-price-binance-security-scare-rattles-crypto-markets.html
TechCrunch, “The worst hacks and breaches of 2026 so far”, 15 September 2026. techcrunch.com/2026/09/15/the-worst-hacks-and-breaches-of-2026-so-far
The Hacker News, “North Korea-linked hackers target developers with malicious VS Code projects”, January 2026. thehackernews.com/2026/01/north-korea-linked-hackers-target.html