By Mark MacDonald, Director of Product Marketing

By now you’ve heard the news and seen the number: $6.34 billion stolen from Binance on October 29. It’s the biggest crypto theft on record, widely attributed to TraderTraitor, a North Korean group. 

The scale and sophistication are completely unprecedented and very technical especially if you don’t understand the intricacies of cryptocurrency architecture. To be clear, we’re not going to touch any of that. Instead, we’re going to keep it (relatively) simple and focus on one line in Binance’s own timeline: a June 2026 infostealer infection of a single wallet DevOps engineer, which the company contained at the time. Binance’s own wording implies that what the attacker learned from that infection mattered in the months that followed. How could a stolen log, plus a few public profiles, turn into a convincing approach to a target? This piece speculates, clearly labeled as such, on the role AI-powered profiling may play, and what defenders can do about it now.

How the Attack Unfolded

Binance’s November 3 LinkedIn update opens its attack timeline with this entry:  

June 2026: Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.

The tampered homebrew installation cited by Binance deployed macOS Stealer malware. They responded appropriately, but it’s that last sentence that is easy to overlook. Binance is implying that the attacker(s) learned something valuable about their victim and that it played a role in what happened in the months to come. Binance goes on to describe a coordinated and persistent campaign:

 “Fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.”

All of this begs the question: Exactly how was the exposed engineer’s information leveraged in this next phase of the attack? 

To be clear, we don’t know for sure and probably never will. From here on out, we are speculating, but there’s good reason to think that AI tools being used to precisely profile victims and supercharge social engineering efforts played some kind of role. 

Every Stealer Log Tells a Story 

A typical macOS infostealer typically pulls the following off of an infected machine:

• Login keychain: A fake password prompt captures the macOS password, which lets the attacker decrypt the keychain. That exposes saved app and Wi-Fi passwords and the keys protecting browser-stored credentials.
• Browser data: Saved passwords, autofill entries, payment cards, history, and cookies
• Session cookies: A stolen cookie for a live session can get an attacker in without a password or an MFA prompt, until the session is revoked
• Crypto wallets: Desktop wallet files and browser extension data
• System profile: Hostname, username, installed software, and IP address

Binance’s June response covers most of that list. Devices get replaced, passwords get changed, sessions get revoked, wallets get moved. The immediate risks are remediated but that does not change the fact that the attacker walked away with a lot of information. The credentials and keys may not work anymore but that doesn’t mean the information can’t be used in other ways.  

A stealer log gives a detailed look at a machine, its user, their permissions, and their behavior. Paired with general OSINT through searching LinkedIn profiles, GitHub repos, other sources of public information, and you have plenty of information to provide an LLM to craft high-efficacy social engineering content and strategies. 

Infostealer Affiliates are Marketing AI-Powered Profiling Features

Flare has observed a number of malware variants advertising AI-powered profiling features. Bee Stealer V2.1 is a recently observed Windows infostealer that was seen marketing updates containing an “AI Profile” feature in the summer of 2026. The feature enables an attacker to send large parts of each stolen log to a server-side neural network. The purported output is two text files, with a short dossier on the victim: inferred profession, interests, and key domains. The security vendor BlackFrog conducted a test to produce both output files in October 2026, but in general, the consistent quality and utility of these profiles were unverified as of this writing.

Bee Stealer V2.1 discussion in Exploit (Flare link to post, sign up for the free trial to access if you aren’t already a customer)

Overall, between late July and the end of October 2026, at least two other malware variants – AVENGER and VOLTA-AUTODOXER – advertising similar features were observed by Flare, indicating a trend and potential demand for these features in the crowded and competitive infostealer black market. 

StealerLens 

Earlier this year, our researchers proved the utility of combining stealer logs with LLMs with StealerLens. The full writeup is worth reading, and its framing of the problem sums it up:

Over 50 million stealer logs surfaced on underground channels in 2025. Each one is dozens of file artifacts containing tens of thousands of lines of browser history, session cookies, and stolen browser credentials. Somewhere in that pile sits the answer to the question every incident responder actually cares about: how did this machine get infected, and what is the impact on my organization? Gathering that intelligence by hand, though, is so slow that in practice almost nobody does.

StealerLens traces the source of an infection from the log itself to give an infection hypothesis. In the example below, it points to a pirated copy of Adobe software. It can also deliver a verdict if the device is likely a corporate machine or not based on the contents of the stealer log file. To be clear, StealerLens is a forensic tool, not a malicious profiling tool. But clearly the line between these two use cases is very thin and blurry! 

StealerLens is a free forensic tool available to Flare Discord Verified community members. To access it, join the Flare Academy Discord Community (if you aren’t a member already) and follow the steps in the #verify-here channel. 

What Can You Do to Improve Your Posture?

Becoming resilient to this kind of profiling and social engineering in a post-AI world is no small task. As profiling accuracy improves with richer input data, the time between initial infection and targeted exploitation will likely shrink, and the window for incident response shrinks with it. Thinking like an attacker with AI tools at their disposal, and understanding how exposed information might be used, is a good place to start:

• Find out which infostealer infections are already affecting your organization. Vendors, including Flare (with a collection of 150M+ stealer logs as of this writing), can provide the whole log context, not just usernames and passwords.
• Also with Flare, Identity Exposure Management (IEM) gives you a blast radius view of potential attack pathways. Our new posture management capabilities also lets you map those exposures against identity security best practices.
• Outside of Flare, you may be able to use other AI security applications you have access to for a red teamer’s view of a log. Use the insights to run intelligence-driven pen tests or red team exercises, or to give users training tailored to the approaches an attacker might use.

What We Know, and What We Don’t

We don’t know how much of this played into the Binance attack. What we do know is that Binance’s own timeline notes that after the June infection, Engineer A’s role and colleagues were exposed to the attacker.

We also know with more certainty that stealer logs, LLMs, and classic social engineering together let an attacker research and approach targets at a speed and scale that manual research can’t match. Analyzing your own stealer logs the way an attacker would is a practical first step to becoming resilient to this emerging tactic.