Binance Discloses $6.34B Theft via Fake Job Interview, AI Tool Abuse by North Korea's TraderTraitor/Lazarus
Binance published findings on a multi-stage intrusion that began in June 2026 with a tampered Homebrew install targeting a Wallet DevOps engineer, and escalated in September when another engineer was lured through a fake job interview and tricked into downloading a malicious code repository disguised as a technical assignment. The malware established C2 communications and was later used to pivot into Binance's internal AI tool, which the attacker abused to gain control over two other engineers, including the originally compromised Wallet DevOps engineer whose machine held a container deployment permission token. On October 29, attackers used stolen credentials to deploy a malicious container and script, reaching Binance's wallet signing service and executing unauthorized transactions across XRP, SOL, OP, BTC and ETH, abusing Ethereum's EIP-7702 mechanism to grant a malicious smart contract execution rights over a hot wallet. The FBI attributed the attack to the North Korea-linked TraderTraitor group (Lazarus Group/APT38). Binance estimates $6.34 billion in assets affected, with $2.85 billion frozen/intercepted and 98% of lost tokens already replenished as of October 31.
Detalhes técnicos
The attack chain combined social engineering (fake recruiter and CEO personas via a job platform), a malicious code repository delivered as a technical assignment, obfuscated malware that replaced a legitimate dev tool component, lateral movement via a compromised internal AI application, theft of a container deployment token, and abuse of EIP-7702 account delegation to grant a rogue smart contract execution rights over a Binance hot wallet. Because Binance uses Multi-Party Computation (MPC) wallets, there was no single private key to revoke, requiring a custom remediation procedure; the final unauthorized transfer (2,961.9 ETH) was finalized at 23:56 UTC Oct 29 and the malicious authorization cleared at 00:10 UTC Oct 30. Binance also disclosed detecting and blocking 57 suspected North Korea-linked threat cases in 2026, and the article references a related joint advisory (Japan NPA, FBI, DoD Cyber Crime Center, Australia, Germany) on the WaterPlum/Contagious Interview group, which infected over 30,000 devices across 100+ countries and stole from 7,000+ crypto wallets, totaling about $10.71 million funneled to North Korea, linking operators to the DPRK's 313 General Bureau.
Remediação
Binance rebuilt affected wallet infrastructure and the internal AI tool, replaced compromised devices, revoked associated credentials and tokens, strengthened endpoint monitoring and wallet-service controls, and is engaging independent cybersecurity firms to review the incident. The article recommends running technical assignments in isolated environments, using short-lived and tightly restricted deployment credentials, and ensuring internal AI tools never inherit unnecessary access to sensitive systems.
Linha do tempo
-
Binance Discloses $6.34B Theft via Fake Job Interview, AI Tool Abuse by North Korea's TraderTraitor/Lazarus
ler a análise desta fonte ocultar
Binance published findings on a multi-stage intrusion that began in June 2026 with a tampered Homebrew install targeting a Wallet DevOps engineer, and escalated in September when another engineer was lured through a fake job interview and tricked into downloading a malicious code repository disguised as a technical assignment. The malware established C2 communications and was later used to pivot into Binance's internal AI tool, which the attacker abused to gain control over two other engineers, including the originally compromised Wallet DevOps engineer whose machine held a container deployment permission token. On October 29, attackers used stolen credentials to deploy a malicious container and script, reaching Binance's wallet signing service and executing unauthorized transactions across XRP, SOL, OP, BTC and ETH, abusing Ethereum's EIP-7702 mechanism to grant a malicious smart contract execution rights over a hot wallet. The FBI attributed the attack to the North Korea-linked TraderTraitor group (Lazarus Group/APT38). Binance estimates $6.34 billion in assets affected, with $2.85 billion frozen/intercepted and 98% of lost tokens already replenished as of October 31.
Technical Details
The attack chain combined social engineering (fake recruiter and CEO personas via a job platform), a malicious code repository delivered as a technical assignment, obfuscated malware that replaced a legitimate dev tool component, lateral movement via a compromised internal AI application, theft of a container deployment token, and abuse of EIP-7702 account delegation to grant a rogue smart contract execution rights over a Binance hot wallet. Because Binance uses Multi-Party Computation (MPC) wallets, there was no single private key to revoke, requiring a custom remediation procedure; the final unauthorized transfer (2,961.9 ETH) was finalized at 23:56 UTC Oct 29 and the malicious authorization cleared at 00:10 UTC Oct 30. Binance also disclosed detecting and blocking 57 suspected North Korea-linked threat cases in 2026, and the article references a related joint advisory (Japan NPA, FBI, DoD Cyber Crime Center, Australia, Germany) on the WaterPlum/Contagious Interview group, which infected over 30,000 devices across 100+ countries and stole from 7,000+ crypto wallets, totaling about $10.71 million funneled to North Korea, linking operators to the DPRK's 313 General Bureau.
Remediation
Binance rebuilt affected wallet infrastructure and the internal AI tool, replaced compromised devices, revoked associated credentials and tokens, strengthened endpoint monitoring and wallet-service controls, and is engaging independent cybersecurity firms to review the incident. The article recommends running technical assignments in isolated environments, using short-lived and tightly restricted deployment credentials, and ensuring internal AI tools never inherit unnecessary access to sensitive systems.