Binance loses ~$6.34B to DPRK TraderTraitor via fake job interview, trojanized Homebrew and abused internal AI tool

Linha do tempo

1. helpnetsecurity.com ↗ · pub. 04/11/2026 07:29 · coletado 04/11 09:00

   North Korea's TraderTraitor Steals $6.34B from Binance via Fake Job Interview and EIP-7702 Exploit

   ler a análise desta fonte ocultar

   Binance disclosed that a combination of social engineering, a tampered Homebrew installer, zero-day malware delivered through a fake job interview, compromised internal AI tooling, and abuse of Ethereum's EIP-7702 authorization mechanism led to the theft of approximately $6.34 billion in digital assets on October 29, 2026, making it the largest crypto heist on record. The FBI attributed the attack to TraderTraitor, the North Korean group also behind the $1.5 billion Bybit hack of February 2025. Tether, Circle and other partners helped freeze nearly $3 billion of the stolen funds within the first day, and Binance pledged to cover all user losses, reporting 98% replenishment as of early November. Binance co-founder Changpeng Zhao publicly acknowledged "serious security failures," while security researchers criticized the exchange's use of the term "0-day malware" to describe the incident.

   Technical Details

   The intrusion began in June 2026 when a Wallet DevOps engineer installed a tampered version of Homebrew while searching for an AI coding tool; Binance's security team caught this early but the attackers had already identified the engineer's role and colleagues. In September, attackers targeted a different software engineer via a fake job offer on a legitimate job-hunting platform, posing as a "Project Director" and later a fake "CEO," ultimately convincing the target to download a malicious code repository during a fake technical assessment. This malware swapped the legitimate pyenv executable in the Homebrew directory for a malicious copy, launching a zsh process undetected by endpoint security. On October 20, attackers used the compromised machine and an internal Binance AI tool to pivot into two more engineers' systems, discovering a container deployment permission token belonging to the original DevOps engineer. On October 29, the attacker used stolen credentials to deploy a malicious container and script, gaining unauthorized access to Binance's internal wallet-signing service, which was then used to exploit EIP-7702 to grant an attacker-controlled smart contract partial execution rights over the Binance14 hot wallet.

   Remediation

   Binance removed the EIP-7702 delegation code from the Binance14 hot wallet the day after the theft and reports no further unauthorized transfers. The exchange has scanned all employee devices, engaged independent security firms for review, and stated the investigation remains ongoing subject to further independent verification. Security experts recommend stricter controls on what can be downloaded and executed on corporate devices, as well as tighter permission management for employee accounts.

2. securityweek.com ↗ · pub. 04/11/2026 07:36 · coletado 04/11 09:00

   Binance Details $6.34B Heist: Fake Job Interview, Trojanized Coding Assignment and AI Tool Abuse Led to Wallet Compromise

   ler a análise desta fonte ocultar

   Binance published its initial incident report on the $6.34 billion theft from its hot wallets, attributing the intrusion to North Korea's TraderTraitor group (per FBI attribution). The campaign ran for months, compromising three wallet/DevOps engineers through a tampered Homebrew installation, a fake recruiting and interview process, and a trojanized coding 'assignment' that deployed previously undetected 0-day malware. Attackers used a compromised engineer's container-deployment token and an internal AI tool (Binance did not explain how) to pivot across systems and ultimately abuse an internal wallet signing service, exploiting Ethereum's EIP-7702 delegation mechanism to gain partial execution rights over a multi-party-computation (MPC) hot wallet that could not be revoked with a single key. Roughly $2.85 billion has since been frozen or intercepted, and Binance says it has rebuilt the affected wallet system and AI tool, rotated credentials, and is funding AI-security research for blockchain. Elliptic reported the stolen funds moved through ~12,000 wallets across 11 blockchains in under four days using automation (no AI-driven decision-making observed), with about $3.18 billion still in theft-linked addresses as of November 3.

   Technical Details

   The attack chain began in June when a Wallet DevOps engineer downloaded a malicious Homebrew package while searching for an AI coding tool, giving attackers reconnaissance on the wallet infrastructure team before the device was swapped. In September, a second engineer was socially engineered through fake HR and 'CEO' interviews, culminating in a malicious code repository disguised as a coding assignment that substituted a rogue developer-tool component and established C2 — malware that evaded endpoint protection at the time. On October 20, attackers used this foothold plus the internal AI tool to seize control of two more engineers' machines. By October 29, they deployed a malicious container using a stolen deployment token, exploited unauthorized access to the internal wallet signing service, moved XRP, SOL, OP and BTC, and abused EIP-7702 to grant a malicious contract execution rights over a hot wallet, with the last unauthorized transfer settling at 23:56 UTC.

   Remediation

   Binance rebuilt the compromised wallet system and AI tool, replaced affected devices, revoked engineer credentials and tokens, is engaging independent security firms for review, and has resumed withdrawals in phases while issuing zero-knowledge proofs of reserves.

3. securityonline.info ↗ · pub. 03/11/2026 20:52 · coletado 04/11 08:52

   Binance Hot Wallets Drained of $6.34B via Social Engineering, Supply-Chain Malware and EIP-7702 Abuse; North Korea Blamed

   ler a análise desta fonte ocultar

   Binance disclosed details of a sophisticated, months-long intrusion culminating in an October 29, 2026 theft of approximately $6.34 billion from its hot wallets. Attackers compromised engineers through a tampered Homebrew installer in June and a fake job interview with malicious assignment code in September, eventually gaining access to an internal AI tool and a container deployment token used to execute the heist. The attackers abused Ethereum's EIP-7702 feature to grant a malicious smart contract partial control over a hot wallet, allowing transfers to continue even after Binance suspended withdrawals. Binance attributes the attack to North Korea (DPRK) based on FBI information, and says it has frozen or intercepted about $2.85 billion and replenished 98% of affected assets, while committing to cover all user losses.

   Technical Details

   The attack chain began with a supply-chain compromise: a wallet engineer downloaded a trojanized Homebrew installer while setting up an AI coding tool in June 2026. In September, a second engineer was lured through two staged fake job interviews and tricked into downloading a malicious "assignment" that swapped a legitimate developer tool for a rogue copy, evading endpoint protection. From this foothold, attackers abused an internal AI tool to pivot to two more engineers, one of whom held a container deployment token used on October 29. During the theft, five hot wallets sent 233.46 million XRP to an attacker address within four minutes, followed by transfers from Solana, Optimism, and Bitcoin wallets. The attacker then exploited EIP-7702, which allows an account to delegate execution rights to a smart contract, giving the attacker's contract partial control that operated independently of Binance's normal withdrawal infrastructure — meaning suspending withdrawals did not stop all transfers. The final unauthorized transfer settled at 23:56 UTC. The FBI stated the stolen assets are expected to be laundered through DeFi and instant swap services.

   Remediation

   Binance has rebuilt its wallet system and internal AI tool, replaced compromised devices, and revoked related credentials, and is engaging outside security firms for an independent review. Recommended defensive measures include treating job offers requiring code execution on work machines as red flags, installing developer tools only from official sources, restricting internal AI tool and deployment token permissions, and actively monitoring and revoking EIP-7702 delegations on high-value wallets.

4. hackread.com ↗ · pub. 04/11/2026 06:34 · coletado 04/11 07:01

   Binance Confirms $6.34B Theft via Fake Job Interviews and Compromised Internal AI Tool

   ler a análise desta fonte ocultar

   Binance published an initial incident report on November 3, 2026 detailing how attackers linked by the FBI to North Korea stole approximately $6.34 billion in cryptocurrency on October 29, 2026. The campaign began in June when a wallet DevOps engineer downloaded a tampered Homebrew installation, giving attackers knowledge of the wallet team's structure despite remediation. In September, a second engineer was approached via a fake recruiter on a job-hunting platform and tricked into downloading a malicious coding assignment that replaced a legitimate pyenv file with malware, enabling command execution and C2 contact. On October 20, attackers pivoted using an internal AI tool to reach two more engineers' devices, one holding a container deployment token, which was ultimately used to deploy a malicious script and drain multiple hot wallets across XRP, Solana, Optimism, BTC and ETH.

   Technical Details

   Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP, followed by roughly 970,500 SOL, 44.2 million OP, 18,270 BTC and a final 2,961.9 ETH transfer settling at 23:56 UTC. Attackers abused Ethereum's EIP-7702 account-authorization mechanism to grant an attacker-controlled smart contract partial execution rights over a hot wallet without exposing its private key. Because Binance's wallets use multi-party computation (MPC), there was no single key to revoke these authorizations, delaying containment until the malicious delegation was cleared at 00:10 UTC on October 30.

   Remediation

   Binance says it has rebuilt affected systems, replaced compromised devices, tightened access controls, and committed to covering all losses from company funds. As of November 3, about $2.85 billion had been frozen or intercepted and 98% of affected token assets had been replenished with replacement funds, though the investigation remains ongoing and will be reviewed by independent cybersecurity firms.

5. infosecurity-magazine.com ↗ · pub. 04/11/2026 06:25 · coletado 04/11 07:01

   Fake Job Interview Social Engineering Chain Leads to Binance's Record-Breaking Crypto Heist

   ler a análise desta fonte ocultar

   Binance disclosed that a months-long, multi-stage social engineering and malware campaign — not a single breach — led to a record-breaking theft of crypto assets. Attackers posed as recruiters on a legitimate job-hunting platform to target multiple Binance software engineers, building trust over fake interviews before delivering a malicious code repository disguised as a technical assignment. The resulting zero-day malware used obfuscation and evasion techniques, replacing a legitimate development tool component to execute commands and establish C2 communication. From this initial foothold, attackers pivoted through an internal AI tool to compromise additional wallet engineers, eventually obtaining a container deployment token and stolen credentials that let them deploy a malicious container and drain Binance hot wallets.

   Technical Details

   The intrusion began in September when an attacker posing as a project director contacted "Software Engineer B" via a job platform, followed by fake HR and social-chat interviews designed to build trust before delivering a malicious "assignment" repository that executed during setup. Separately, in June, "Wallet DevOps Engineer A" had been compromised via a malicious version of Homebrew downloaded after clicking a malicious search ad; though the device was replaced and credentials rotated, the attacker had already learned the roles of the wallet team. On October 20, the attacker used Engineer B's access to an internal AI tool to pivot into the machines of Engineer A and "Wallet Software Engineer C," discovering a container deployment permission token on Engineer A's device. On October 29 between 17:15–19:56 UTC, the attacker logged into Engineer C's machine using Engineer A's stolen credentials, deployed a container, and triggered a malicious script. Between 20:05 and 20:09 UTC, five Binance hot wallets sent approximately 233.46 million XRP, 970,500 SOL, and 44.2 million OP to attacker-controlled addresses. Binance stated it has detected and prevented 57 suspected North Korean attacks this year.

   Remediation

   Binance rebuilt the affected wallet system and internal AI tool, strengthened the AI tool's access controls, replaced affected devices, decommissioned exposed engineer credentials and tokens, enhanced device security scanning, improved AI-based behavioral anomaly detection, and strengthened wallet service risk controls. The firm is conducting an incident review and establishing a security research fund with industry partners.

6. gbhackers.com ↗ · pub. 04/11/2026 03:18 · coletado 04/11 05:00

   Binance Details $6.3B Crypto Heist via Fake Job Interviews and Compromised DevOps Engineers Linked to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance disclosed the technical details behind a $6.34 billion cryptocurrency theft executed on October 29, 2026, attributing the attack to North Korea's TraderTraitor cluster based on FBI findings. The intrusion began months earlier with a tampered Homebrew installer delivered to a Wallet DevOps engineer in June, followed by a fake recruitment scheme in September that compromised another engineer via a malicious assignment repository replacing the legitimate pyenv binary. Attackers pivoted laterally using an internal AI tool and a stolen container deployment token, ultimately reaching Binance's internal wallet signing service. They abused Ethereum's EIP-7702 authorization mechanism to grant an attacker-controlled contract execution rights over a hot wallet, submitting 50 signing transactions to manipulate account nonces, with unauthorized transfers including XRP, SOL, OP, and BTC. Binance stated it has recovered/frozen roughly $2.85 billion and replenished 98% of affected token assets by October 31.

   Technical Details

   The attack chain: (1) June - tampered Homebrew installer compromised a Wallet DevOps engineer's device while installing an AI coding tool; (2) September - fake recruitment interviews (impersonated HR rep and CEO, using a fabricated social media identity) led an engineer to download a malicious assignment repository that replaced pyenv with an altered executable, spawning zsh; (3) October 20 - attackers used the compromised workstation and an internal AI tool to reach two additional engineers and found a container deployment permission token; (4) October 29, 17:15-19:56 UTC - intruders used stolen credentials to deploy a malicious container and trigger a script reaching the signing service. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key to revoke immediately, requiring Binance to develop a specialized remediation procedure. The final unauthorized transfer (2,961.9 ETH) finalized at 23:56 UTC; Binance cleared the malicious delegation at 00:10 UTC on October 30. The FBI warns attackers are converting stolen assets primarily into ETH before laundering via DeFi and instant-swap services.

   Remediation

   Binance rebuilt affected systems, replaced compromised devices, revoked credentials, and strengthened monitoring; its investigation remains ongoing.

7. theregister.com ↗ · pub. 03/11/2026 19:04 · coletado 03/11 21:00

   Binance $6.3B Heist: North Korean TraderTraitor Used Fake Job Interview to Plant Malware

   ler a análise desta fonte ocultar

   Binance published an incident report detailing how North Korean hackers (attributed by the FBI to TraderTraitor, linked to Lazarus Group) stole $6.3 billion in cryptocurrency on October 29, 2026 through a multi-stage campaign combining social engineering, supply chain compromise, and endpoint takeover. The campaign began in June with a malicious Homebrew installation that exposed an engineer's role on the wallet infrastructure team, followed in September by an elaborate fake job interview targeting another engineer that led to malware delivery via a poisoned code repository. The malware replaced a legitimate pyenv development tool component to establish command-and-control communication, evading Binance's endpoint security. Attackers then used a compromised internal AI tool and stolen credentials to deploy a container and execute the theft.

   Technical Details

   The malware performed file operations replacing /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ and /opt/homebrew/bin/pyenv with a malicious binary, then created a symlink and spawned a zsh shell to execute commands and communicate with an attacker-controlled external server. On October 20, attackers used the compromised computer and an internal AI tool to pivot to wallet DevOps Engineer A and wallet developer Engineer C. Engineer A's container deployment permission token was discovered and later used on October 29 to deploy a container on Engineer C's machine, triggering the theft script via what Binance called an "advanced transaction-authorization method."

   Remediation

   Binance has rebuilt the compromised wallet system and internal AI tool, replaced all affected devices, and decommissioned credentials and tokens tied to the compromised engineers. The exchange is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze stolen assets, has hired independent cybersecurity experts for a full review, and plans to establish a security research fund focused on AI security in blockchain environments.

8. wired.com ↗ · pub. 03/11/2026 16:04 · coletado 03/11 18:01

   Binance Confirms $6.34B Heist Traced to TraderTraitor via Fake Job Interview and Compromised Wallet Signing Service

   ler a análise desta fonte ocultar

   Binance released an updated post-incident report detailing how North Korea-linked TraderTraitor hackers stole $6.34 billion in roughly 20 minutes on October 29, 2026, draining funds across more than 10 blockchains from hot wallets. The intrusion began in June 2026 when an engineer (Engineer A) downloaded a tampered Homebrew installation; information about that engineer was later exposed to the attackers. In September 2026, a second engineer (Engineer B) was targeted via a fake job interview on a legitimate job-hunting platform, culminating in a malicious code repository disguised as a coding assignment that replaced a legitimate development tool component to establish C2 communication. The attackers then pivoted to control Engineer A's wallet and a third engineer's (Engineer C) credentials, ultimately exploiting an internal AI tool and an internal wallet signing service to authorize unauthorized transactions outside normal withdrawal procedures. The FBI publicly attributed the attack to TraderTraitor on October 31, and roughly half the stolen funds have been frozen by industry partners, while the remainder is being laundered by North Korean actors.

   Technical Details

   The attack chain combined social engineering (fake job interview, malicious "assignment" repository), supply-chain-style tampering (malicious Homebrew installation, replaced development tool component), credential theft, lateral movement, abuse of an internal AI tool, and ultimately subversion of a wallet signing service to bypass normal withdrawal authorization. Crypto tracing firm Elliptic reports the laundering operation used approximately 12,000 wallets across 11 blockchains and over 40,000 transactions within the first three and a half days — roughly one new wallet every 25 seconds — indicating automated laundering. TRM Labs estimates North Korean hackers have stolen around $12 billion in cryptocurrency since 2017, with more than half occurring in 2026 alone.

   Remediation

   Binance states it has rebuilt or replaced internal systems impacted in the attack and set aside funds to cover user losses. The company reports it detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, suggesting heightened internal monitoring against this threat actor.

9. techcrunch.com ↗ · pub. 03/11/2026 16:45 · coletado 03/11 18:00

   Binance Details $6.3B Heist: North Korean Hackers Used Fake Job Offer to Breach Wallet Engineer

   ler a análise desta fonte ocultar

   Binance has confirmed that the record $6.3 billion cryptocurrency theft disclosed last week stemmed from a months-long social engineering campaign attributed to North Korean state-sponsored hackers. The attackers posed as recruiters, lured a software engineer on Binance's wallet team through a fake interview process, and delivered malware disguised as a coding assignment that went undetected by Binance's security tools. From that foothold, the hackers pivoted through an internal tool to compromise two more engineers, including one previously infected via a trojanized app downloaded from search results, eventually gaining access to systems controlling billions in crypto. Binance says it has since improved network security and will bring in external cybersecurity experts to review the incident, which it says it faced in at least 57 prior suspected North Korean intrusion attempts.

   Technical Details

   The attack chain began with a fake recruiter persona contacting a Binance wallet engineer; after two interviews, the target was told to download a coding assignment that contained malicious code, compromising their work laptop undetected. This access was leveraged to reach an internal administrative tool capable of taking over other engineers' machines. A second engineer had separately been compromised months earlier by a tampered application containing credential-stealing malware found via search engine results. Stolen credentials from that engineer were used to access a third engineer's system, which had privileged access to crypto custody infrastructure, enabling the theft.

   Remediation

   Binance states it has implemented new security measures following the breach and will engage third-party cybersecurity experts to review the incident; the article notes the company has not detailed what controls prevent unauthorized or untrusted code execution on employee laptops.

10. securityaffairs.com ↗ · pub. 03/11/2026 16:44 · coletado 03/11 18:00

    Binance Discloses $6.34B Theft via Fake Job Interview, AI Tool Abuse by North Korea's TraderTraitor/Lazarus

    ler a análise desta fonte ocultar

    Binance published findings on a multi-stage intrusion that began in June 2026 with a tampered Homebrew install targeting a Wallet DevOps engineer, and escalated in September when another engineer was lured through a fake job interview and tricked into downloading a malicious code repository disguised as a technical assignment. The malware established C2 communications and was later used to pivot into Binance's internal AI tool, which the attacker abused to gain control over two other engineers, including the originally compromised Wallet DevOps engineer whose machine held a container deployment permission token. On October 29, attackers used stolen credentials to deploy a malicious container and script, reaching Binance's wallet signing service and executing unauthorized transactions across XRP, SOL, OP, BTC and ETH, abusing Ethereum's EIP-7702 mechanism to grant a malicious smart contract execution rights over a hot wallet. The FBI attributed the attack to the North Korea-linked TraderTraitor group (Lazarus Group/APT38). Binance estimates $6.34 billion in assets affected, with $2.85 billion frozen/intercepted and 98% of lost tokens already replenished as of October 31.

    Technical Details

    The attack chain combined social engineering (fake recruiter and CEO personas via a job platform), a malicious code repository delivered as a technical assignment, obfuscated malware that replaced a legitimate dev tool component, lateral movement via a compromised internal AI application, theft of a container deployment token, and abuse of EIP-7702 account delegation to grant a rogue smart contract execution rights over a Binance hot wallet. Because Binance uses Multi-Party Computation (MPC) wallets, there was no single private key to revoke, requiring a custom remediation procedure; the final unauthorized transfer (2,961.9 ETH) was finalized at 23:56 UTC Oct 29 and the malicious authorization cleared at 00:10 UTC Oct 30. Binance also disclosed detecting and blocking 57 suspected North Korea-linked threat cases in 2026, and the article references a related joint advisory (Japan NPA, FBI, DoD Cyber Crime Center, Australia, Germany) on the WaterPlum/Contagious Interview group, which infected over 30,000 devices across 100+ countries and stole from 7,000+ crypto wallets, totaling about $10.71 million funneled to North Korea, linking operators to the DPRK's 313 General Bureau.

    Remediation

    Binance rebuilt affected wallet infrastructure and the internal AI tool, replaced compromised devices, revoked associated credentials and tokens, strengthened endpoint monitoring and wallet-service controls, and is engaging independent cybersecurity firms to review the incident. The article recommends running technical assignments in isolated environments, using short-lived and tightly restricted deployment credentials, and ensuring internal AI tools never inherit unnecessary access to sensitive systems.

11. bleepingcomputer.com ↗ · pub. 03/11/2026 17:05 · coletado 03/11 18:00

    Binance Confirms North Korean TraderTraitor Group Stole $6.34 Billion via Fake Job Interview Social Engineering

    ler a análise desta fonte ocultar

    Binance published an incident report attributing the October 29 theft of approximately $6.34 billion in cryptocurrency to North Korean state-sponsored hackers tracked as TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The attack began in September when a software engineer was approached on a legitimate job-hunting platform by a fake recruiter posing as a Project Director, who scheduled two fake interviews (HR and CEO impersonators) to build trust before delivering a malicious coding assignment via an online code repository. Executing the assignment deployed a previously unseen, undetected custom malware on the employee's macOS device, which the attackers used to pivot internally, eventually compromising two more employees working on Binance's wallet infrastructure and obtaining credentials and a container deployment token. On October 29, the stolen credentials were used to deploy a malicious script granting access to Binance's wallet signing service, enabling cross-chain transfers of billions in assets, with attackers abusing Ethereum's EIP-7702 authorization mechanism to continue stealing funds even after withdrawals were suspended.

    Technical Details

    The malware replaced the legitimate pyenv executable in the macOS Homebrew installation directory with a malicious binary named pyenv_, deleted the original, renamed the malicious file to pyenv, and modified its symbolic link to spawn a zsh process that executed commands from an attacker-controlled server. The malware used sophisticated obfuscation and evasion techniques and was not detected by endpoint security tools at the time of the intrusion. Attackers also leveraged an internal AI tool on the compromised engineer's machine to assist in compromising additional staff.

    Remediation

    Binance rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, about $2.85 billion of stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance has engaged independent security firms to continue the investigation.

12. olhardigital.com.br ↗ · pub. 03/11/2026 14:34 · coletado 03/11 16:01

    Binance Details $6.3 Billion Crypto Heist via Fake Job Interview and AI-Assisted Intrusion

    ler a análise desta fonte ocultar

    Binance disclosed details of a $6.3 billion cryptocurrency theft that occurred on October 29, 2026, potentially the largest financial heist on record. Attackers combined social engineering, a trojanized AI tool, and abuse of Binance's internal AI system to compromise employee workstations and ultimately access wallet infrastructure. The campaign began in June when a wallet development team member downloaded a compromised AI tool; despite remediation, the attackers retained visibility into the team's functions. In September, a second engineer was lured through a fake job interview involving a fraudulent CEO video call, leading to the download of a malicious code repository that compromised another wallet-team device. On October 20, attackers leveraged the infected machine together with Binance's internal AI tool to seize control of two wallet developers' systems, culminating on October 29 in execution of a malicious script using stolen credentials that triggered the theft. The FBI attributed the attack to a North Korean hacking group, an accusation rejected by North Korea's government. Binance is reimbursing all affected customers.

    Technical Details

    The intrusion chain involved: (1) a trojanized AI tool downloaded in June compromising a wallet developer's workstation; (2) a fake recruitment process in September using a staged video interview with a fictitious CEO to deliver a malicious code repository to a second engineer; (3) abuse of Binance's internal AI tool on October 20 combined with the compromised device to take control of two wallet developers' systems; (4) on October 29, execution of a malicious script using the second developer's machine and credentials stolen from the first, triggering the $6.3 billion theft.

    Remediation

    Binance stated it is reimbursing all customers who lost funds and announced plans to expand AI-based detection tooling, establish a security research fund, and launch collaborative security projects with leading AI companies.

13. safedep.io ↗ · pub. 03/11/2026 12:00 · coletado 03/11 16:00

    Binance Loses $6.34B as DPRK-Linked Attackers Compromise Developer Laptops via Fake Job Interview and Tampered Homebrew

    ler a análise desta fonte ocultar

    On October 29, 2026, attackers drained approximately $6.34 billion from Binance hot wallets, with partners freezing or intercepting about $2.85 billion; Binance is covering user losses. The FBI attributes the attack to North Korea (DPRK). The intrusion began in June when a wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool, revealing the wallet team's composition to the attacker. In September, a second engineer was targeted via a fake recruiter and fake interview process on a job platform, leading to malware execution through a poisoned take-home assignment that replaced pyenv with a malicious copy. In October, the attacker pivoted from that laptop through an internal AI tool to compromise two more wallet engineers, stole a container deployment token, and used the wallet signing service to push unauthorized hot wallet transfers and establish a malicious EIP-7702 delegation. Binance states it has stopped 57 other suspected DPRK-linked attempts in 2026 using similar tactics.

    Technical Details

    The initial compromise exploited a tampered Homebrew installation; the logged-in user's ownership of /opt/homebrew allowed malware to replace tools without a password prompt, and endpoint tools did not detect the malicious pyenv binary, which executed commands and beaconed to an attacker server. The second-stage compromise used a fake recruiter persona ("HR representative" and fake "CEO") across a video call and chat app to deliver a malicious assignment repository that ran code during setup. The attacker then used an internal AI tool from the compromised laptop to gain control over two more engineers' machines, retrieved a container deployment token, deployed a container, and used it to run an attack script against the wallet signing service. Between 20:05–23:56 UTC on October 29, unauthorized transfers occurred, including 50 transactions establishing an EIP-7702 delegation that gave an attacker-controlled contract partial control of a hot wallet; this delegation remained active on-chain after withdrawals were halted because the wallet's MPC scheme had no single key for fast revocation. SafeDep assesses the social-engineering pattern matches the Contagious Interview campaign, previously linked to malware such as OverLord stealer and PolinRider, though Binance itself does not name a specific campaign.

    Remediation

    Binance replaced the affected device and rotated credentials after the first compromise; broader remediation details (container token revocation, signing service hardening) were not fully disclosed in the source report.

14. thehackernews.com ↗ · pub. 03/11/2026 13:55 · coletado 03/11 15:00 primeiro registro

    Binance Details $6.43B Theft via Fake Job Interviews, Trojanized Homebrew, and Compromised Internal AI Tool

    ler a análise desta fonte ocultar

    Binance disclosed details of a record-setting $6.43 billion cryptocurrency theft, describing it as a multi-stage campaign rather than a single breach. The intrusion began in June 2026 when a Wallet DevOps engineer ('Engineer A') downloaded a trojanized Homebrew installer while searching for an AI tool, exposing details about his role and colleagues on the wallet infrastructure team. In September 2026, attackers used a fake recruitment scheme—posing as a 'Project Director' and conducting fake HR and CEO interviews—to trick a second engineer ('Engineer B') into downloading a malicious code repository disguised as a job assignment. The compromise escalated on October 20, 2026 when attackers abused an internal AI tool via Engineer B's compromised machine to gain control over Engineer A and a third engineer ('Engineer C'), ultimately using stolen container deployment credentials to access the internal wallet signing service and initiate unauthorized transactions on October 29, 2026.

    Technical Details

    The attack chain combined a supply-chain compromise (trojanized Homebrew installer), recruitment-themed social engineering across two interview rounds (HR persona and fake CEO), a malicious code repository with obfuscated/evasive code that replaced a legitimate development tool component to establish C2 communication, forensic artifact cleanup, abuse of an internal AI tool to pivot to other engineers, theft of a container deployment permission token, and unauthorized use of an internal wallet signing service to bypass normal withdrawal processes.

    Remediation

    Binance rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices, decommissioned compromised credentials and tokens, ran enhanced security scans across employee devices, strengthened wallet-service risk controls, enhanced AI-based behavioral anomaly detection, and worked with law enforcement and blockchain intelligence firms to trace and freeze stolen assets. Binance states it has foiled 57 suspected North Korea-linked cyber threat cases since the start of 2026, noting techniques including fake job interviews, trojanized developer tools, compromised packages/extensions, and fake video conferencing apps targeting the crypto industry.