Binance Confirms $6.34B Theft via Fake Job Interviews and Compromised Internal AI Tool
Binance published an initial incident report on November 3, 2026 detailing how attackers linked by the FBI to North Korea stole approximately $6.34 billion in cryptocurrency on October 29, 2026. The campaign began in June when a wallet DevOps engineer downloaded a tampered Homebrew installation, giving attackers knowledge of the wallet team's structure despite remediation. In September, a second engineer was approached via a fake recruiter on a job-hunting platform and tricked into downloading a malicious coding assignment that replaced a legitimate pyenv file with malware, enabling command execution and C2 contact. On October 20, attackers pivoted using an internal AI tool to reach two more engineers' devices, one holding a container deployment token, which was ultimately used to deploy a malicious script and drain multiple hot wallets across XRP, Solana, Optimism, BTC and ETH.
Detalhes técnicos
Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP, followed by roughly 970,500 SOL, 44.2 million OP, 18,270 BTC and a final 2,961.9 ETH transfer settling at 23:56 UTC. Attackers abused Ethereum's EIP-7702 account-authorization mechanism to grant an attacker-controlled smart contract partial execution rights over a hot wallet without exposing its private key. Because Binance's wallets use multi-party computation (MPC), there was no single key to revoke these authorizations, delaying containment until the malicious delegation was cleared at 00:10 UTC on October 30.
Remediação
Binance says it has rebuilt affected systems, replaced compromised devices, tightened access controls, and committed to covering all losses from company funds. As of November 3, about $2.85 billion had been frozen or intercepted and 98% of affected token assets had been replenished with replacement funds, though the investigation remains ongoing and will be reviewed by independent cybersecurity firms.
Linha do tempo
-
Binance Confirms $6.34B Theft via Fake Job Interviews and Compromised Internal AI Tool
ler a análise desta fonte ocultar
Binance published an initial incident report on November 3, 2026 detailing how attackers linked by the FBI to North Korea stole approximately $6.34 billion in cryptocurrency on October 29, 2026. The campaign began in June when a wallet DevOps engineer downloaded a tampered Homebrew installation, giving attackers knowledge of the wallet team's structure despite remediation. In September, a second engineer was approached via a fake recruiter on a job-hunting platform and tricked into downloading a malicious coding assignment that replaced a legitimate pyenv file with malware, enabling command execution and C2 contact. On October 20, attackers pivoted using an internal AI tool to reach two more engineers' devices, one holding a container deployment token, which was ultimately used to deploy a malicious script and drain multiple hot wallets across XRP, Solana, Optimism, BTC and ETH.
Technical Details
Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP, followed by roughly 970,500 SOL, 44.2 million OP, 18,270 BTC and a final 2,961.9 ETH transfer settling at 23:56 UTC. Attackers abused Ethereum's EIP-7702 account-authorization mechanism to grant an attacker-controlled smart contract partial execution rights over a hot wallet without exposing its private key. Because Binance's wallets use multi-party computation (MPC), there was no single key to revoke these authorizations, delaying containment until the malicious delegation was cleared at 00:10 UTC on October 30.
Remediation
Binance says it has rebuilt affected systems, replaced compromised devices, tightened access controls, and committed to covering all losses from company funds. As of November 3, about $2.85 billion had been frozen or intercepted and 98% of affected token assets had been replenished with replacement funds, though the investigation remains ongoing and will be reviewed by independent cybersecurity firms.