Binance traces $6.34 billion theft to fake job interview and an internal AI tool
Binance's first incident report says a months-long campaign compromised three engineers' computers before attackers reached its wallet signing systems. The FBI has blamed TraderTraitor.
Binance published its initial incident report on November 3, saying the hackers behind last week's $6.34 billion theft reached its wallet signing systems after a months-long campaign that compromised three engineers' computers. Roughly $2.85 billion of the stolen assets has been frozen or intercepted. The FBI has blamed TraderTraitor, a North Korean state-sponsored group. Pyongyang has rejected that attribution.
The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Binance's security team caught it, swapped the device and reset credentials, but the attackers had already learned what he did and who he worked with.
In September a second engineer was walked through two fake interviews and asked to download a coding "assignment" onto his work computer. It hid a malicious repository that ran on setup. Binance says the malware was not detected by endpoint protection at the time.
On October 20 the attackers used the infected machine and an internal AI tool to gain control of the first engineer's system and a third engineer's system. The report doesn't explain how the AI tool was used. A container deployment followed on October 29, then unauthorized access to the wallet signing service moved XRP, SOL, OP and BTC out of hot wallets, and Ethereum's EIP-7702 mechanism was abused to give an attacker-controlled contract partial execution rights over a hot wallet.
The hot wallet used multi-party computation, so Binance had no single key to cancel the delegation immediately. The last unauthorized transfer settled at 23:56 UTC and the delegation was cleared shortly after midnight.
Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers' credentials and tokens. It says it blocked 57 suspected North Korea-linked threats this year.
For defenders, the report is a reminder that a fake recruiter's "assignment" is still the entry point, and that a caught intrusion on one laptop doesn't end the campaign. We'd treat the AI tool's role as the open question here; Binance hasn't said how it was abused.
Sources
- Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance HeistPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
