Binance Details $6.3B Crypto Heist via Fake Job Interviews and Compromised DevOps Engineers Linked to North Korea's TraderTraitor
Binance disclosed the technical details behind a $6.34 billion cryptocurrency theft executed on October 29, 2026, attributing the attack to North Korea's TraderTraitor cluster based on FBI findings. The intrusion began months earlier with a tampered Homebrew installer delivered to a Wallet DevOps engineer in June, followed by a fake recruitment scheme in September that compromised another engineer via a malicious assignment repository replacing the legitimate pyenv binary. Attackers pivoted laterally using an internal AI tool and a stolen container deployment token, ultimately reaching Binance's internal wallet signing service. They abused Ethereum's EIP-7702 authorization mechanism to grant an attacker-controlled contract execution rights over a hot wallet, submitting 50 signing transactions to manipulate account nonces, with unauthorized transfers including XRP, SOL, OP, and BTC. Binance stated it has recovered/frozen roughly $2.85 billion and replenished 98% of affected token assets by October 31.
Detalhes técnicos
The attack chain: (1) June - tampered Homebrew installer compromised a Wallet DevOps engineer's device while installing an AI coding tool; (2) September - fake recruitment interviews (impersonated HR rep and CEO, using a fabricated social media identity) led an engineer to download a malicious assignment repository that replaced pyenv with an altered executable, spawning zsh; (3) October 20 - attackers used the compromised workstation and an internal AI tool to reach two additional engineers and found a container deployment permission token; (4) October 29, 17:15-19:56 UTC - intruders used stolen credentials to deploy a malicious container and trigger a script reaching the signing service. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key to revoke immediately, requiring Binance to develop a specialized remediation procedure. The final unauthorized transfer (2,961.9 ETH) finalized at 23:56 UTC; Binance cleared the malicious delegation at 00:10 UTC on October 30. The FBI warns attackers are converting stolen assets primarily into ETH before laundering via DeFi and instant-swap services.
Remediação
Binance rebuilt affected systems, replaced compromised devices, revoked credentials, and strengthened monitoring; its investigation remains ongoing.
Linha do tempo
-
Binance Details $6.3B Crypto Heist via Fake Job Interviews and Compromised DevOps Engineers Linked to North Korea's TraderTraitor
ler a análise desta fonte ocultar
Binance disclosed the technical details behind a $6.34 billion cryptocurrency theft executed on October 29, 2026, attributing the attack to North Korea's TraderTraitor cluster based on FBI findings. The intrusion began months earlier with a tampered Homebrew installer delivered to a Wallet DevOps engineer in June, followed by a fake recruitment scheme in September that compromised another engineer via a malicious assignment repository replacing the legitimate pyenv binary. Attackers pivoted laterally using an internal AI tool and a stolen container deployment token, ultimately reaching Binance's internal wallet signing service. They abused Ethereum's EIP-7702 authorization mechanism to grant an attacker-controlled contract execution rights over a hot wallet, submitting 50 signing transactions to manipulate account nonces, with unauthorized transfers including XRP, SOL, OP, and BTC. Binance stated it has recovered/frozen roughly $2.85 billion and replenished 98% of affected token assets by October 31.
Technical Details
The attack chain: (1) June - tampered Homebrew installer compromised a Wallet DevOps engineer's device while installing an AI coding tool; (2) September - fake recruitment interviews (impersonated HR rep and CEO, using a fabricated social media identity) led an engineer to download a malicious assignment repository that replaced pyenv with an altered executable, spawning zsh; (3) October 20 - attackers used the compromised workstation and an internal AI tool to reach two additional engineers and found a container deployment permission token; (4) October 29, 17:15-19:56 UTC - intruders used stolen credentials to deploy a malicious container and trigger a script reaching the signing service. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key to revoke immediately, requiring Binance to develop a specialized remediation procedure. The final unauthorized transfer (2,961.9 ETH) finalized at 23:56 UTC; Binance cleared the malicious delegation at 00:10 UTC on October 30. The FBI warns attackers are converting stolen assets primarily into ETH before laundering via DeFi and instant-swap services.
Remediation
Binance rebuilt affected systems, replaced compromised devices, revoked credentials, and strengthened monitoring; its investigation remains ongoing.