On 3 November 2026, Binance published its first report on the theft of about $6.34 billion in digital assets from its hot wallets on 29 October. The attack did not start with a flaw in the exchange's wallet software. It started on engineers' computers: a tampered installer downloaded while searching for an AI coding tool, a coding "assignment" from a fake recruiter that ran on a work laptop, and an internal AI tool that the attackers used to take over two more engineers' machines.
Two days earlier, on 31 October, the FBI had attributed the theft to TraderTraitor, a North Korea-linked group also tracked as Lazarus Group, Jade Sleet and APT38. Binance says it will cover the losses itself, and that about $2.85 billion has been frozen or intercepted so far. Those are crypto-market details. The part that matters for everyone else is the route in.
Engineering teams that use Autodesk Inventor work in a very similar way to the people who were hit. They install tools, run scripts, try AI assistants, store logins and keys on their workstations, and talk to recruiters. Their computers hold Vault access, API credentials and the design files that make up most of a manufacturer's know-how. This article walks through what Binance has confirmed, what is still unknown, and what CAD managers and Inventor users should check now.
TL;DR: The $6.34 billion Binance theft began with engineers, not with a wallet bug. One engineer installed a tampered tool in June, a second ran a fake job test on a work computer in September, and in October the attackers used an internal AI tool and a deployment token stored on a laptop to reach the wallet signing service.
Binance has not named the AI tools involved or explained how the internal one was abused. For Inventor teams the lessons are practical: install tools only from approved sources, never run job tests or unknown code on work machines, give AI agents, MCP connections and add-ins as little access as possible, keep keys and tokens off local disks, separate admin logins, review iLogic in files from outside, and keep dated proof of your designs that does not depend on one computer staying clean.
What happened at Binance?
According to Binance's report, the attackers worked for months. In June 2026, a Wallet DevOps engineer used a search engine to look for an AI coding tool and downloaded what the report calls a "tampered Homebrew installation". Homebrew is a widely used package manager for installing developer tools. Binance's security team spotted the anomaly, replaced the device and rotated the related credentials. But the report adds that the engineer's role and his colleagues on the wallet infrastructure team had already been exposed.
In September, a second engineer was contacted on a job platform by someone posing as a project director. A video interview with a supposed HR representative followed, and in a later interview the engineer was told to download an "assignment" onto his work computer. It was a malicious code repository. Its setup script replaced a legitimate component of pyenv, a common Python version manager, with a malicious version. Binance says the malware was new and evaded the endpoint protection it had in place at the time.
On 20 October, the attackers used that compromised computer and an internal AI tool to gain control of two more engineers' machines, one of them belonging to the first engineer. On his computer they found a container deployment token. On 29 October, between 17:15 and 19:56 UTC, they used it to deploy a container and run a script that gave them access to an internal wallet signing service. Unauthorized transfers of XRP, SOL, OP, BTC and ETH followed that evening. Binance cleared the last attacker permission shortly after midnight UTC on 30 October.
What is confirmed, and what is not?
The primary source is Binance's own incident report of 3 November 2026. It gives the timeline, the roles of the three engineers, the assets moved and the response. Binance says it has rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced the affected devices, withdrawn the related credentials and tokens, and scanned all employee devices. Some technical details will stay confidential.
The FBI alert of 31 October, reported by BleepingComputer, names TraderTraitor and lists more than 600 addresses that exchanges are asked to block. Co-CEO Richard Teng told CNBC that the attackers "spent months building their way in", and rejected the idea that one laptop was the single point of failure.
Several important details are not public. Binance has not named the AI coding tool the first engineer was looking for, has not named the internal AI tool, and has not explained how the attackers used it to reach other computers. It is also not established that the attackers kept access continuously from June to October. As far as is known, no design files or CAD data were involved.
Why should Inventor teams care about a crypto exchange?
Because the targets were engineers with access to valuable systems, and the methods do not depend on crypto. The same group has used fake recruiters before. In the 2024 theft from Japan's DMM Bitcoin, the FBI said an attacker posing as a recruiter got an employee of a software supplier to run malicious Python code disguised as a pre-employment test. Security researchers have described similar fake job campaigns against drone makers and defence suppliers this year, which we covered on BORIS for SOLIDWORKS in our article on fake job offers aimed at engineers.
A typical Inventor workstation is a rich target. It often has a Vault client with saved access, mapped drives with project folders, VPN profiles, licence settings, and the Inventor files themselves: parts, assemblies, drawings and the parameters and rules inside them. Engineers who automate Inventor may also keep Python, Git, Visual Studio, API keys for Autodesk Platform Services and service account logins on the same machine. If someone takes over that computer, they do not need to break into Vault separately. They can use what the engineer can use.
That is why insider-style cases matter even when no insider is involved. In the Jingdiao case, a machine maker was ordered to pay 381.63 million yuan after a former employee took 37,340 design drawings. In Binance's case, the attackers did not need a former employee. They borrowed the access of current ones.
Where are AI tools in this story?
In two places. First, the June infection began with a search for an AI coding tool. Popular tools attract fake download pages and tampered installers, so a quick search and a click is a real risk. We saw a related case on 29 October, when a trojanized Claude Code extension appeared on the Cursor marketplace for about eleven hours.
Second, an internal AI tool became a bridge between computers. Binance has not said how. But the general point is clear: an AI tool that can run commands, read files or act on other machines carries the access of whoever runs it, and in the wrong hands that access becomes the attacker's. This is directly relevant to Inventor teams. Inventor 2027.2 added a local MCP server that lets AI agents such as Cursor, Claude Code or GitHub Copilot inspect and change the model in an open Inventor session, and Autodesk is expanding Autodesk Assistant across its products. These tools save time, but they need clear limits on who may connect them, to what, and with which rights.
What does the Binance chain look like in an Inventor office?
The table maps each step of the attack to the equivalent risk around Inventor and Vault, and to the control that would make it harder.
Most of these controls are not new. They are the basics behind CAD file protection with Vault, encryption and proof of ownership and security protocols for remote CAD teams. What the Binance case shows is how attackers chain small gaps together over months until they reach the one system that matters.
Your Inventor files are your company's know-how. Keep proof of what you designed and when.
BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and gives you a certificate of ownership, straight from Inventor.
👉 See how BORIS for Autodesk Inventor works
What about iLogic, add-ins and files from outside?
Inventor is not only a modeller. iLogic rules are Visual Basic code stored in parts, assemblies or external rule files, and event triggers can run them when a document opens or is saved. Add-ins run with the same rights as Inventor itself. That is why iLogic and Inventor add-ins and the API are so useful, and also why files and add-ins from unknown sources deserve the care you would give to any program.
A test model sent by a recruiter, a "sample assembly" from a new contact or a free add-in from an unofficial page should be treated as code, not as a drawing. Open such files on a separate machine, check what rules and triggers they contain before you run them, and keep add-in installation in the hands of IT or the CAD manager. Autodesk's own advisories show that CAD software has its share of security flaws: the Fusion advisories of 27 October are one recent example.
What should Inventor teams do now?
- Use approved sources only. Install Inventor add-ins, AI assistants, converters and developer tools from Autodesk, the vendor or an internal list, never from a search result or an advert.
- Keep job tests off work machines. Tell engineers that coding tests, sample models and "assignments" from recruiters run on a personal or spare machine without company access. Do the same for test files you receive from candidates.
- Limit AI agents. Decide which AI tools may connect to Inventor through MCP or other integrations, on which machines, with which rights, and log what they do.
- Get tokens off local disks. Move APS client secrets, Vault service logins and saved passwords into a password manager or secrets vault, prefer short-lived tokens, and rotate anything that has been sitting in a script.
- Separate admin from daily work. Vault administrators and IT staff should use separate admin accounts, ideally from a separate machine, with alerts on bulk downloads and unusual lifecycle changes.
- Treat iLogic and add-ins as code. Review rules and triggers in files from outside before running them, and control who can install add-ins.
- Assume knowledge after an incident. When a device is cleaned up, also assume the attacker learned who does what. Warn colleagues in the same team and watch for targeted contact.
- Keep dated proof. Register key design versions with BORIS so you can show what you designed and when, independent of any single workstation or server.
Training helps more than any single tool here, because each step started with a person making a reasonable-looking choice. Our guides on training engineers on CAD data protection and common CAD security mistakes are a good starting point. For the legal side, see what the SS&C v. Arcesium ruling says about access and trade secrets and how blockchain timestamps help prove design authorship.
The bigger picture
This week's news on our sister sites shows the same theme from other angles: access, rules and proof.
- Remote access with a weak spot. BORIS for SOLIDWORKS explains the SonicWall SSL-VPN flaw that can let attackers with valid credentials bypass SAML and multifactor login, and what engineering teams should check on the VPN that protects their PDM and file servers.
- EU funding with IP rules attached. On CADChain, the EIC Work Programme 2027 sets out EUR 1.8 billion in funding, together with the IP strategy, freedom-to-operate and results-sharing rules that applicants must meet.
- Free assets, new AI terms. Blended BORIS covers Quixel Megascans becoming free on Fab again, with updated terms that allow AI training on the scans and what that means for 3D artists.
Conclusion
The largest crypto theft on record did not rely on breaking cryptography. It relied on an engineer searching for a tool, another engineer trusting a job interview, an internal AI tool with too much reach, and a token left on a laptop. Each step looked small; together they opened the most sensitive system the company had.
Inventor teams hold a different kind of asset, but the path to it is the same: the people who design, their workstations, and the tools and agents they connect. Tighten what gets installed, where tests run, what AI tools may do and where secrets live. And keep independent, dated proof of your designs, so that a compromised machine never decides what you can prove.
Your designs, your proof.
BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, straight from Inventor.
👉 Protect your Inventor designs with BORIS
FAQ: the Binance hack and engineering workstations
How did the Binance hack start?
According to Binance's report of 3 November 2026, it started in June 2026 when an engineer downloaded a tampered installer while searching for an AI coding tool. In September a second engineer ran a malicious job test on a work computer, and in October the attackers used an internal AI tool and a stolen deployment token to reach the wallet signing service.
How much was stolen?
Binance estimates that about $6.34 billion in digital assets was affected on 29 October 2026. It says about $2.85 billion has been frozen or intercepted and that it will absorb the losses, not its users.
Who is behind it?
The FBI attributed the theft on 31 October 2026 to TraderTraitor, a North Korea-linked group also known as Lazarus Group, Jade Sleet and APT38.
Which AI tools were involved?
Binance has not named either the AI coding tool the first engineer searched for or the internal AI tool the attackers used, and it has not explained how the internal tool was abused.
Were CAD files or design data stolen?
No. As far as is known, this case was about crypto wallets. It matters to Inventor teams because the same methods work against engineers who hold design data and Vault access.
What should an engineer do if a recruiter sends a test?
Do not run it on a work computer. Use a personal or spare machine without company access, and tell your IT or CAD manager if anything about the request looks unusual.
How does BORIS help?
BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when. It does not replace endpoint security, access control or secure hiring practices.