North Korea's TraderTraitor Steals $6.34B from Binance via Fake Job Interview and EIP-7702 Exploit
Binance disclosed that a combination of social engineering, a tampered Homebrew installer, zero-day malware delivered through a fake job interview, compromised internal AI tooling, and abuse of Ethereum's EIP-7702 authorization mechanism led to the theft of approximately $6.34 billion in digital assets on October 29, 2026, making it the largest crypto heist on record. The FBI attributed the attack to TraderTraitor, the North Korean group also behind the $1.5 billion Bybit hack of February 2025. Tether, Circle and other partners helped freeze nearly $3 billion of the stolen funds within the first day, and Binance pledged to cover all user losses, reporting 98% replenishment as of early November. Binance co-founder Changpeng Zhao publicly acknowledged "serious security failures," while security researchers criticized the exchange's use of the term "0-day malware" to describe the incident.
Detalhes técnicos
The intrusion began in June 2026 when a Wallet DevOps engineer installed a tampered version of Homebrew while searching for an AI coding tool; Binance's security team caught this early but the attackers had already identified the engineer's role and colleagues. In September, attackers targeted a different software engineer via a fake job offer on a legitimate job-hunting platform, posing as a "Project Director" and later a fake "CEO," ultimately convincing the target to download a malicious code repository during a fake technical assessment. This malware swapped the legitimate pyenv executable in the Homebrew directory for a malicious copy, launching a zsh process undetected by endpoint security. On October 20, attackers used the compromised machine and an internal Binance AI tool to pivot into two more engineers' systems, discovering a container deployment permission token belonging to the original DevOps engineer. On October 29, the attacker used stolen credentials to deploy a malicious container and script, gaining unauthorized access to Binance's internal wallet-signing service, which was then used to exploit EIP-7702 to grant an attacker-controlled smart contract partial execution rights over the Binance14 hot wallet.
Remediação
Binance removed the EIP-7702 delegation code from the Binance14 hot wallet the day after the theft and reports no further unauthorized transfers. The exchange has scanned all employee devices, engaged independent security firms for review, and stated the investigation remains ongoing subject to further independent verification. Security experts recommend stricter controls on what can be downloaded and executed on corporate devices, as well as tighter permission management for employee accounts.
Linha do tempo
-
North Korea's TraderTraitor Steals $6.34B from Binance via Fake Job Interview and EIP-7702 Exploit
ler a análise desta fonte ocultar
Binance disclosed that a combination of social engineering, a tampered Homebrew installer, zero-day malware delivered through a fake job interview, compromised internal AI tooling, and abuse of Ethereum's EIP-7702 authorization mechanism led to the theft of approximately $6.34 billion in digital assets on October 29, 2026, making it the largest crypto heist on record. The FBI attributed the attack to TraderTraitor, the North Korean group also behind the $1.5 billion Bybit hack of February 2025. Tether, Circle and other partners helped freeze nearly $3 billion of the stolen funds within the first day, and Binance pledged to cover all user losses, reporting 98% replenishment as of early November. Binance co-founder Changpeng Zhao publicly acknowledged "serious security failures," while security researchers criticized the exchange's use of the term "0-day malware" to describe the incident.
Technical Details
The intrusion began in June 2026 when a Wallet DevOps engineer installed a tampered version of Homebrew while searching for an AI coding tool; Binance's security team caught this early but the attackers had already identified the engineer's role and colleagues. In September, attackers targeted a different software engineer via a fake job offer on a legitimate job-hunting platform, posing as a "Project Director" and later a fake "CEO," ultimately convincing the target to download a malicious code repository during a fake technical assessment. This malware swapped the legitimate pyenv executable in the Homebrew directory for a malicious copy, launching a zsh process undetected by endpoint security. On October 20, attackers used the compromised machine and an internal Binance AI tool to pivot into two more engineers' systems, discovering a container deployment permission token belonging to the original DevOps engineer. On October 29, the attacker used stolen credentials to deploy a malicious container and script, gaining unauthorized access to Binance's internal wallet-signing service, which was then used to exploit EIP-7702 to grant an attacker-controlled smart contract partial execution rights over the Binance14 hot wallet.
Remediation
Binance removed the EIP-7702 delegation code from the Binance14 hot wallet the day after the theft and reports no further unauthorized transfers. The exchange has scanned all employee devices, engaged independent security firms for review, and stated the investigation remains ongoing subject to further independent verification. Security experts recommend stricter controls on what can be downloaded and executed on corporate devices, as well as tighter permission management for employee accounts.