Binance Hot Wallets Drained of $6.34B via Social Engineering, Supply-Chain Malware and EIP-7702 Abuse; North Korea Blamed
Binance disclosed details of a sophisticated, months-long intrusion culminating in an October 29, 2026 theft of approximately $6.34 billion from its hot wallets. Attackers compromised engineers through a tampered Homebrew installer in June and a fake job interview with malicious assignment code in September, eventually gaining access to an internal AI tool and a container deployment token used to execute the heist. The attackers abused Ethereum's EIP-7702 feature to grant a malicious smart contract partial control over a hot wallet, allowing transfers to continue even after Binance suspended withdrawals. Binance attributes the attack to North Korea (DPRK) based on FBI information, and says it has frozen or intercepted about $2.85 billion and replenished 98% of affected assets, while committing to cover all user losses.
Detalhes técnicos
The attack chain began with a supply-chain compromise: a wallet engineer downloaded a trojanized Homebrew installer while setting up an AI coding tool in June 2026. In September, a second engineer was lured through two staged fake job interviews and tricked into downloading a malicious "assignment" that swapped a legitimate developer tool for a rogue copy, evading endpoint protection. From this foothold, attackers abused an internal AI tool to pivot to two more engineers, one of whom held a container deployment token used on October 29. During the theft, five hot wallets sent 233.46 million XRP to an attacker address within four minutes, followed by transfers from Solana, Optimism, and Bitcoin wallets. The attacker then exploited EIP-7702, which allows an account to delegate execution rights to a smart contract, giving the attacker's contract partial control that operated independently of Binance's normal withdrawal infrastructure — meaning suspending withdrawals did not stop all transfers. The final unauthorized transfer settled at 23:56 UTC. The FBI stated the stolen assets are expected to be laundered through DeFi and instant swap services.
Remediação
Binance has rebuilt its wallet system and internal AI tool, replaced compromised devices, and revoked related credentials, and is engaging outside security firms for an independent review. Recommended defensive measures include treating job offers requiring code execution on work machines as red flags, installing developer tools only from official sources, restricting internal AI tool and deployment token permissions, and actively monitoring and revoking EIP-7702 delegations on high-value wallets.
Linha do tempo
-
Binance Hot Wallets Drained of $6.34B via Social Engineering, Supply-Chain Malware and EIP-7702 Abuse; North Korea Blamed
ler a análise desta fonte ocultar
Binance disclosed details of a sophisticated, months-long intrusion culminating in an October 29, 2026 theft of approximately $6.34 billion from its hot wallets. Attackers compromised engineers through a tampered Homebrew installer in June and a fake job interview with malicious assignment code in September, eventually gaining access to an internal AI tool and a container deployment token used to execute the heist. The attackers abused Ethereum's EIP-7702 feature to grant a malicious smart contract partial control over a hot wallet, allowing transfers to continue even after Binance suspended withdrawals. Binance attributes the attack to North Korea (DPRK) based on FBI information, and says it has frozen or intercepted about $2.85 billion and replenished 98% of affected assets, while committing to cover all user losses.
Technical Details
The attack chain began with a supply-chain compromise: a wallet engineer downloaded a trojanized Homebrew installer while setting up an AI coding tool in June 2026. In September, a second engineer was lured through two staged fake job interviews and tricked into downloading a malicious "assignment" that swapped a legitimate developer tool for a rogue copy, evading endpoint protection. From this foothold, attackers abused an internal AI tool to pivot to two more engineers, one of whom held a container deployment token used on October 29. During the theft, five hot wallets sent 233.46 million XRP to an attacker address within four minutes, followed by transfers from Solana, Optimism, and Bitcoin wallets. The attacker then exploited EIP-7702, which allows an account to delegate execution rights to a smart contract, giving the attacker's contract partial control that operated independently of Binance's normal withdrawal infrastructure — meaning suspending withdrawals did not stop all transfers. The final unauthorized transfer settled at 23:56 UTC. The FBI stated the stolen assets are expected to be laundered through DeFi and instant swap services.
Remediation
Binance has rebuilt its wallet system and internal AI tool, replaced compromised devices, and revoked related credentials, and is engaging outside security firms for an independent review. Recommended defensive measures include treating job offers requiring code execution on work machines as red flags, installing developer tools only from official sources, restricting internal AI tool and deployment token permissions, and actively monitoring and revoking EIP-7702 delegations on high-value wallets.