Binance Loses $6.34B as DPRK-Linked Attackers Compromise Developer Laptops via Fake Job Interview and Tampered Homebrew
On October 29, 2026, attackers drained approximately $6.34 billion from Binance hot wallets, with partners freezing or intercepting about $2.85 billion; Binance is covering user losses. The FBI attributes the attack to North Korea (DPRK). The intrusion began in June when a wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool, revealing the wallet team's composition to the attacker. In September, a second engineer was targeted via a fake recruiter and fake interview process on a job platform, leading to malware execution through a poisoned take-home assignment that replaced pyenv with a malicious copy. In October, the attacker pivoted from that laptop through an internal AI tool to compromise two more wallet engineers, stole a container deployment token, and used the wallet signing service to push unauthorized hot wallet transfers and establish a malicious EIP-7702 delegation. Binance states it has stopped 57 other suspected DPRK-linked attempts in 2026 using similar tactics.
Detalhes técnicos
The initial compromise exploited a tampered Homebrew installation; the logged-in user's ownership of /opt/homebrew allowed malware to replace tools without a password prompt, and endpoint tools did not detect the malicious pyenv binary, which executed commands and beaconed to an attacker server. The second-stage compromise used a fake recruiter persona ("HR representative" and fake "CEO") across a video call and chat app to deliver a malicious assignment repository that ran code during setup. The attacker then used an internal AI tool from the compromised laptop to gain control over two more engineers' machines, retrieved a container deployment token, deployed a container, and used it to run an attack script against the wallet signing service. Between 20:05–23:56 UTC on October 29, unauthorized transfers occurred, including 50 transactions establishing an EIP-7702 delegation that gave an attacker-controlled contract partial control of a hot wallet; this delegation remained active on-chain after withdrawals were halted because the wallet's MPC scheme had no single key for fast revocation. SafeDep assesses the social-engineering pattern matches the Contagious Interview campaign, previously linked to malware such as OverLord stealer and PolinRider, though Binance itself does not name a specific campaign.
Remediação
Binance replaced the affected device and rotated credentials after the first compromise; broader remediation details (container token revocation, signing service hardening) were not fully disclosed in the source report.
Linha do tempo
-
Binance Loses $6.34B as DPRK-Linked Attackers Compromise Developer Laptops via Fake Job Interview and Tampered Homebrew
ler a análise desta fonte ocultar
On October 29, 2026, attackers drained approximately $6.34 billion from Binance hot wallets, with partners freezing or intercepting about $2.85 billion; Binance is covering user losses. The FBI attributes the attack to North Korea (DPRK). The intrusion began in June when a wallet DevOps engineer installed a tampered Homebrew package while searching for an AI coding tool, revealing the wallet team's composition to the attacker. In September, a second engineer was targeted via a fake recruiter and fake interview process on a job platform, leading to malware execution through a poisoned take-home assignment that replaced pyenv with a malicious copy. In October, the attacker pivoted from that laptop through an internal AI tool to compromise two more wallet engineers, stole a container deployment token, and used the wallet signing service to push unauthorized hot wallet transfers and establish a malicious EIP-7702 delegation. Binance states it has stopped 57 other suspected DPRK-linked attempts in 2026 using similar tactics.
Technical Details
The initial compromise exploited a tampered Homebrew installation; the logged-in user's ownership of
/opt/homebrewallowed malware to replace tools without a password prompt, and endpoint tools did not detect the malicious pyenv binary, which executed commands and beaconed to an attacker server. The second-stage compromise used a fake recruiter persona ("HR representative" and fake "CEO") across a video call and chat app to deliver a malicious assignment repository that ran code during setup. The attacker then used an internal AI tool from the compromised laptop to gain control over two more engineers' machines, retrieved a container deployment token, deployed a container, and used it to run an attack script against the wallet signing service. Between 20:05–23:56 UTC on October 29, unauthorized transfers occurred, including 50 transactions establishing an EIP-7702 delegation that gave an attacker-controlled contract partial control of a hot wallet; this delegation remained active on-chain after withdrawals were halted because the wallet's MPC scheme had no single key for fast revocation. SafeDep assesses the social-engineering pattern matches the Contagious Interview campaign, previously linked to malware such as OverLord stealer and PolinRider, though Binance itself does not name a specific campaign.Remediation
Binance replaced the affected device and rotated credentials after the first compromise; broader remediation details (container token revocation, signing service hardening) were not fully disclosed in the source report.