Binance loses ~$6.34B to DPRK TraderTraitor via fake job interview, trojanized Homebrew and abused internal AI tool

Linha do tempo

1. theregister.com ↗ · pub. 03/11/2026 19:04 · coletado 03/11 21:00

   Binance $6.3B Heist: North Korean TraderTraitor Used Fake Job Interview to Plant Malware

   ler a análise desta fonte ocultar

   Binance published an incident report detailing how North Korean hackers (attributed by the FBI to TraderTraitor, linked to Lazarus Group) stole $6.3 billion in cryptocurrency on October 29, 2026 through a multi-stage campaign combining social engineering, supply chain compromise, and endpoint takeover. The campaign began in June with a malicious Homebrew installation that exposed an engineer's role on the wallet infrastructure team, followed in September by an elaborate fake job interview targeting another engineer that led to malware delivery via a poisoned code repository. The malware replaced a legitimate pyenv development tool component to establish command-and-control communication, evading Binance's endpoint security. Attackers then used a compromised internal AI tool and stolen credentials to deploy a container and execute the theft.

   Technical Details

   The malware performed file operations replacing /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ and /opt/homebrew/bin/pyenv with a malicious binary, then created a symlink and spawned a zsh shell to execute commands and communicate with an attacker-controlled external server. On October 20, attackers used the compromised computer and an internal AI tool to pivot to wallet DevOps Engineer A and wallet developer Engineer C. Engineer A's container deployment permission token was discovered and later used on October 29 to deploy a container on Engineer C's machine, triggering the theft script via what Binance called an "advanced transaction-authorization method."

   Remediation

   Binance has rebuilt the compromised wallet system and internal AI tool, replaced all affected devices, and decommissioned credentials and tokens tied to the compromised engineers. The exchange is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze stolen assets, has hired independent cybersecurity experts for a full review, and plans to establish a security research fund focused on AI security in blockchain environments.

2. wired.com ↗ · pub. 03/11/2026 16:04 · coletado 03/11 18:01

   Binance Confirms $6.34B Heist Traced to TraderTraitor via Fake Job Interview and Compromised Wallet Signing Service

   ler a análise desta fonte ocultar

   Binance released an updated post-incident report detailing how North Korea-linked TraderTraitor hackers stole $6.34 billion in roughly 20 minutes on October 29, 2026, draining funds across more than 10 blockchains from hot wallets. The intrusion began in June 2026 when an engineer (Engineer A) downloaded a tampered Homebrew installation; information about that engineer was later exposed to the attackers. In September 2026, a second engineer (Engineer B) was targeted via a fake job interview on a legitimate job-hunting platform, culminating in a malicious code repository disguised as a coding assignment that replaced a legitimate development tool component to establish C2 communication. The attackers then pivoted to control Engineer A's wallet and a third engineer's (Engineer C) credentials, ultimately exploiting an internal AI tool and an internal wallet signing service to authorize unauthorized transactions outside normal withdrawal procedures. The FBI publicly attributed the attack to TraderTraitor on October 31, and roughly half the stolen funds have been frozen by industry partners, while the remainder is being laundered by North Korean actors.

   Technical Details

   The attack chain combined social engineering (fake job interview, malicious "assignment" repository), supply-chain-style tampering (malicious Homebrew installation, replaced development tool component), credential theft, lateral movement, abuse of an internal AI tool, and ultimately subversion of a wallet signing service to bypass normal withdrawal authorization. Crypto tracing firm Elliptic reports the laundering operation used approximately 12,000 wallets across 11 blockchains and over 40,000 transactions within the first three and a half days — roughly one new wallet every 25 seconds — indicating automated laundering. TRM Labs estimates North Korean hackers have stolen around $12 billion in cryptocurrency since 2017, with more than half occurring in 2026 alone.

   Remediation

   Binance states it has rebuilt or replaced internal systems impacted in the attack and set aside funds to cover user losses. The company reports it detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, suggesting heightened internal monitoring against this threat actor.

3. techcrunch.com ↗ · pub. 03/11/2026 16:45 · coletado 03/11 18:00

   Binance Details $6.3B Heist: North Korean Hackers Used Fake Job Offer to Breach Wallet Engineer

   ler a análise desta fonte ocultar

   Binance has confirmed that the record $6.3 billion cryptocurrency theft disclosed last week stemmed from a months-long social engineering campaign attributed to North Korean state-sponsored hackers. The attackers posed as recruiters, lured a software engineer on Binance's wallet team through a fake interview process, and delivered malware disguised as a coding assignment that went undetected by Binance's security tools. From that foothold, the hackers pivoted through an internal tool to compromise two more engineers, including one previously infected via a trojanized app downloaded from search results, eventually gaining access to systems controlling billions in crypto. Binance says it has since improved network security and will bring in external cybersecurity experts to review the incident, which it says it faced in at least 57 prior suspected North Korean intrusion attempts.

   Technical Details

   The attack chain began with a fake recruiter persona contacting a Binance wallet engineer; after two interviews, the target was told to download a coding assignment that contained malicious code, compromising their work laptop undetected. This access was leveraged to reach an internal administrative tool capable of taking over other engineers' machines. A second engineer had separately been compromised months earlier by a tampered application containing credential-stealing malware found via search engine results. Stolen credentials from that engineer were used to access a third engineer's system, which had privileged access to crypto custody infrastructure, enabling the theft.

   Remediation

   Binance states it has implemented new security measures following the breach and will engage third-party cybersecurity experts to review the incident; the article notes the company has not detailed what controls prevent unauthorized or untrusted code execution on employee laptops.

4. securityaffairs.com ↗ · pub. 03/11/2026 16:44 · coletado 03/11 18:00

   Binance Discloses $6.34B Theft via Fake Job Interview, AI Tool Abuse by North Korea's TraderTraitor/Lazarus

   ler a análise desta fonte ocultar

   Binance published findings on a multi-stage intrusion that began in June 2026 with a tampered Homebrew install targeting a Wallet DevOps engineer, and escalated in September when another engineer was lured through a fake job interview and tricked into downloading a malicious code repository disguised as a technical assignment. The malware established C2 communications and was later used to pivot into Binance's internal AI tool, which the attacker abused to gain control over two other engineers, including the originally compromised Wallet DevOps engineer whose machine held a container deployment permission token. On October 29, attackers used stolen credentials to deploy a malicious container and script, reaching Binance's wallet signing service and executing unauthorized transactions across XRP, SOL, OP, BTC and ETH, abusing Ethereum's EIP-7702 mechanism to grant a malicious smart contract execution rights over a hot wallet. The FBI attributed the attack to the North Korea-linked TraderTraitor group (Lazarus Group/APT38). Binance estimates $6.34 billion in assets affected, with $2.85 billion frozen/intercepted and 98% of lost tokens already replenished as of October 31.

   Technical Details

   The attack chain combined social engineering (fake recruiter and CEO personas via a job platform), a malicious code repository delivered as a technical assignment, obfuscated malware that replaced a legitimate dev tool component, lateral movement via a compromised internal AI application, theft of a container deployment token, and abuse of EIP-7702 account delegation to grant a rogue smart contract execution rights over a Binance hot wallet. Because Binance uses Multi-Party Computation (MPC) wallets, there was no single private key to revoke, requiring a custom remediation procedure; the final unauthorized transfer (2,961.9 ETH) was finalized at 23:56 UTC Oct 29 and the malicious authorization cleared at 00:10 UTC Oct 30. Binance also disclosed detecting and blocking 57 suspected North Korea-linked threat cases in 2026, and the article references a related joint advisory (Japan NPA, FBI, DoD Cyber Crime Center, Australia, Germany) on the WaterPlum/Contagious Interview group, which infected over 30,000 devices across 100+ countries and stole from 7,000+ crypto wallets, totaling about $10.71 million funneled to North Korea, linking operators to the DPRK's 313 General Bureau.

   Remediation

   Binance rebuilt affected wallet infrastructure and the internal AI tool, replaced compromised devices, revoked associated credentials and tokens, strengthened endpoint monitoring and wallet-service controls, and is engaging independent cybersecurity firms to review the incident. The article recommends running technical assignments in isolated environments, using short-lived and tightly restricted deployment credentials, and ensuring internal AI tools never inherit unnecessary access to sensitive systems.

5. bleepingcomputer.com ↗ · pub. 03/11/2026 17:05 · coletado 03/11 18:00

   Binance Confirms North Korean TraderTraitor Group Stole $6.34 Billion via Fake Job Interview Social Engineering

   ler a análise desta fonte ocultar

   Binance published an incident report attributing the October 29 theft of approximately $6.34 billion in cryptocurrency to North Korean state-sponsored hackers tracked as TraderTraitor, Lazarus Group, Jade Sleet, and APT38. The attack began in September when a software engineer was approached on a legitimate job-hunting platform by a fake recruiter posing as a Project Director, who scheduled two fake interviews (HR and CEO impersonators) to build trust before delivering a malicious coding assignment via an online code repository. Executing the assignment deployed a previously unseen, undetected custom malware on the employee's macOS device, which the attackers used to pivot internally, eventually compromising two more employees working on Binance's wallet infrastructure and obtaining credentials and a container deployment token. On October 29, the stolen credentials were used to deploy a malicious script granting access to Binance's wallet signing service, enabling cross-chain transfers of billions in assets, with attackers abusing Ethereum's EIP-7702 authorization mechanism to continue stealing funds even after withdrawals were suspended.

   Technical Details

   The malware replaced the legitimate pyenv executable in the macOS Homebrew installation directory with a malicious binary named pyenv_, deleted the original, renamed the malicious file to pyenv, and modified its symbolic link to spawn a zsh process that executed commands from an attacker-controlled server. The malware used sophisticated obfuscation and evasion techniques and was not detected by endpoint security tools at the time of the intrusion. Attackers also leveraged an internal AI tool on the compromised engineer's machine to assist in compromising additional staff.

   Remediation

   Binance rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, about $2.85 billion of stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance has engaged independent security firms to continue the investigation.

6. olhardigital.com.br ↗ · pub. 03/11/2026 14:34 · coletado 03/11 16:01

   Binance Details $6.3 Billion Crypto Heist via Fake Job Interview and AI-Assisted Intrusion

   ler a análise desta fonte ocultar

   Binance disclosed details of a $6.3 billion cryptocurrency theft that occurred on October 29, 2026, potentially the largest financial heist on record. Attackers combined social engineering, a trojanized AI tool, and abuse of Binance's internal AI system to compromise employee workstations and ultimately access wallet infrastructure. The campaign began in June when a wallet development team member downloaded a compromised AI tool; despite remediation, the attackers retained visibility into the team's functions. In September, a second engineer was lured through a fake job interview involving a fraudulent CEO video call, leading to the download of a malicious code repository that compromised another wallet-team device. On October 20, attackers leveraged the infected machine together with Binance's internal AI tool to seize control of two wallet developers' systems, culminating on October 29 in execution of a malicious script using stolen credentials that triggered the theft. The FBI attributed the attack to a North Korean hacking group, an accusation rejected by North Korea's government. Binance is reimbursing all affected customers.

   Technical Details

   The intrusion chain involved: (1) a trojanized AI tool downloaded in June compromising a wallet developer's workstation; (2) a fake recruitment process in September using a staged video interview with a fictitious CEO to deliver a malicious code repository to a second engineer; (3) abuse of Binance's internal AI tool on October 20 combined with the compromised device to take control of two wallet developers' systems; (4) on October 29, execution of a malicious script using the second developer's machine and credentials stolen from the first, triggering the $6.3 billion theft.

   Remediation

   Binance stated it is reimbursing all customers who lost funds and announced plans to expand AI-based detection tooling, establish a security research fund, and launch collaborative security projects with leading AI companies.

7. safedep.io ↗ · pub. 03/11/2026 12:00 · coletado 03/11 16:00

   Binance Loses $6.34B as DPRK-Linked Attackers Compromise Developer Laptops via Fake Job Interview and Tampered Homebrew

   ler a análise desta fonte ocultar

   On October 29, 2026, attackers drained approximately $6.34 billion from Binance hot wallets, with partners freezing or intercepting about $2.85 billion; Binance is covering user losses. The FBI attributes the attack to North Korea (DPRK). The intrusion began in June when a wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool, revealing the wallet team's composition to the attacker. In September, a second engineer was targeted via a fake recruiter and fake interview process on a job platform, leading to malware execution through a poisoned take-home assignment that replaced pyenv with a malicious copy. In October, the attacker pivoted from that laptop through an internal AI tool to compromise two more wallet engineers, stole a container deployment token, and used the wallet signing service to push unauthorized hot wallet transfers and establish a malicious EIP-7702 delegation. Binance states it has stopped 57 other suspected DPRK-linked attempts in 2026 using similar tactics.

   Technical Details

   The initial compromise exploited a tampered Homebrew installation; the logged-in user's ownership of /opt/homebrew allowed malware to replace tools without a password prompt, and endpoint tools did not detect the malicious pyenv binary, which executed commands and beaconed to an attacker server. The second-stage compromise used a fake recruiter persona ("HR representative" and fake "CEO") across a video call and chat app to deliver a malicious assignment repository that ran code during setup. The attacker then used an internal AI tool from the compromised laptop to gain control over two more engineers' machines, retrieved a container deployment token, deployed a container, and used it to run an attack script against the wallet signing service. Between 20:05–23:56 UTC on October 29, unauthorized transfers occurred, including 50 transactions establishing an EIP-7702 delegation that gave an attacker-controlled contract partial control of a hot wallet; this delegation remained active on-chain after withdrawals were halted because the wallet's MPC scheme had no single key for fast revocation. SafeDep assesses the social-engineering pattern matches the Contagious Interview campaign, previously linked to malware such as OverLord stealer and PolinRider, though Binance itself does not name a specific campaign.

   Remediation

   Binance replaced the affected device and rotated credentials after the first compromise; broader remediation details (container token revocation, signing service hardening) were not fully disclosed in the source report.

8. thehackernews.com ↗ · pub. 03/11/2026 13:55 · coletado 03/11 15:00 primeiro registro

   Binance Details $6.43B Theft via Fake Job Interviews, Trojanized Homebrew, and Compromised Internal AI Tool

   ler a análise desta fonte ocultar

   Binance disclosed details of a record-setting $6.43 billion cryptocurrency theft, describing it as a multi-stage campaign rather than a single breach. The intrusion began in June 2026 when a Wallet DevOps engineer ('Engineer A') downloaded a trojanized Homebrew installer while searching for an AI tool, exposing details about his role and colleagues on the wallet infrastructure team. In September 2026, attackers used a fake recruitment scheme—posing as a 'Project Director' and conducting fake HR and CEO interviews—to trick a second engineer ('Engineer B') into downloading a malicious code repository disguised as a job assignment. The compromise escalated on October 20, 2026 when attackers abused an internal AI tool via Engineer B's compromised machine to gain control over Engineer A and a third engineer ('Engineer C'), ultimately using stolen container deployment credentials to access the internal wallet signing service and initiate unauthorized transactions on October 29, 2026.

   Technical Details

   The attack chain combined a supply-chain compromise (trojanized Homebrew installer), recruitment-themed social engineering across two interview rounds (HR persona and fake CEO), a malicious code repository with obfuscated/evasive code that replaced a legitimate development tool component to establish C2 communication, forensic artifact cleanup, abuse of an internal AI tool to pivot to other engineers, theft of a container deployment permission token, and unauthorized use of an internal wallet signing service to bypass normal withdrawal processes.

   Remediation

   Binance rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices, decommissioned compromised credentials and tokens, ran enhanced security scans across employee devices, strengthened wallet-service risk controls, enhanced AI-based behavioral anomaly detection, and worked with law enforcement and blockchain intelligence firms to trace and freeze stolen assets. Binance states it has foiled 57 suspected North Korea-linked cyber threat cases since the start of 2026, noting techniques including fake job interviews, trojanized developer tools, compromised packages/extensions, and fake video conferencing apps targeting the crypto industry.