Binance Details $6.34B Heist: Fake Job Interview, Trojanized Coding Assignment and AI Tool Abuse Led to Wallet Compromise
Binance published its initial incident report on the $6.34 billion theft from its hot wallets, attributing the intrusion to North Korea's TraderTraitor group (per FBI attribution). The campaign ran for months, compromising three wallet/DevOps engineers through a tampered Homebrew installation, a fake recruiting and interview process, and a trojanized coding 'assignment' that deployed previously undetected 0-day malware. Attackers used a compromised engineer's container-deployment token and an internal AI tool (Binance did not explain how) to pivot across systems and ultimately abuse an internal wallet signing service, exploiting Ethereum's EIP-7702 delegation mechanism to gain partial execution rights over a multi-party-computation (MPC) hot wallet that could not be revoked with a single key. Roughly $2.85 billion has since been frozen or intercepted, and Binance says it has rebuilt the affected wallet system and AI tool, rotated credentials, and is funding AI-security research for blockchain. Elliptic reported the stolen funds moved through ~12,000 wallets across 11 blockchains in under four days using automation (no AI-driven decision-making observed), with about $3.18 billion still in theft-linked addresses as of November 3.
Detalhes técnicos
The attack chain began in June when a Wallet DevOps engineer downloaded a malicious Homebrew package while searching for an AI coding tool, giving attackers reconnaissance on the wallet infrastructure team before the device was swapped. In September, a second engineer was socially engineered through fake HR and 'CEO' interviews, culminating in a malicious code repository disguised as a coding assignment that substituted a rogue developer-tool component and established C2 — malware that evaded endpoint protection at the time. On October 20, attackers used this foothold plus the internal AI tool to seize control of two more engineers' machines. By October 29, they deployed a malicious container using a stolen deployment token, exploited unauthorized access to the internal wallet signing service, moved XRP, SOL, OP and BTC, and abused EIP-7702 to grant a malicious contract execution rights over a hot wallet, with the last unauthorized transfer settling at 23:56 UTC.
Remediação
Binance rebuilt the compromised wallet system and AI tool, replaced affected devices, revoked engineer credentials and tokens, is engaging independent security firms for review, and has resumed withdrawals in phases while issuing zero-knowledge proofs of reserves.
Linha do tempo
-
Binance Details $6.34B Heist: Fake Job Interview, Trojanized Coding Assignment and AI Tool Abuse Led to Wallet Compromise
ler a análise desta fonte ocultar
Binance published its initial incident report on the $6.34 billion theft from its hot wallets, attributing the intrusion to North Korea's TraderTraitor group (per FBI attribution). The campaign ran for months, compromising three wallet/DevOps engineers through a tampered Homebrew installation, a fake recruiting and interview process, and a trojanized coding 'assignment' that deployed previously undetected 0-day malware. Attackers used a compromised engineer's container-deployment token and an internal AI tool (Binance did not explain how) to pivot across systems and ultimately abuse an internal wallet signing service, exploiting Ethereum's EIP-7702 delegation mechanism to gain partial execution rights over a multi-party-computation (MPC) hot wallet that could not be revoked with a single key. Roughly $2.85 billion has since been frozen or intercepted, and Binance says it has rebuilt the affected wallet system and AI tool, rotated credentials, and is funding AI-security research for blockchain. Elliptic reported the stolen funds moved through ~12,000 wallets across 11 blockchains in under four days using automation (no AI-driven decision-making observed), with about $3.18 billion still in theft-linked addresses as of November 3.
Technical Details
The attack chain began in June when a Wallet DevOps engineer downloaded a malicious Homebrew package while searching for an AI coding tool, giving attackers reconnaissance on the wallet infrastructure team before the device was swapped. In September, a second engineer was socially engineered through fake HR and 'CEO' interviews, culminating in a malicious code repository disguised as a coding assignment that substituted a rogue developer-tool component and established C2 — malware that evaded endpoint protection at the time. On October 20, attackers used this foothold plus the internal AI tool to seize control of two more engineers' machines. By October 29, they deployed a malicious container using a stolen deployment token, exploited unauthorized access to the internal wallet signing service, moved XRP, SOL, OP and BTC, and abused EIP-7702 to grant a malicious contract execution rights over a hot wallet, with the last unauthorized transfer settling at 23:56 UTC.
Remediation
Binance rebuilt the compromised wallet system and AI tool, replaced affected devices, revoked engineer credentials and tokens, is engaging independent security firms for review, and has resumed withdrawals in phases while issuing zero-knowledge proofs of reserves.