Key Notes
- Binance says a fake coding assignment compromised an engineer’s computer in September.
- Attackers used an internal AI tool to reach two other engineers’ devices before targeting wallet signing.
- The exchange reported $6.34 billion in affected assets and about $2.85 billion frozen or intercepted.
A fake job interview helped attackers gain access to Binance’s wallet signing systems before the October 29 theft, the exchange said in its initial investigation. Binance put the value of affected assets at $6.34 billion. Binance report
Binance Chief Security Officer Jimmy Su described the attack sequence in a media briefing, where Richard Teng said the campaign had developed over months. CoinDesk coverage
From Fake Recruitment to Wallet Access
- June: A wallet engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool. Binance replaced the device and rotated credentials, but the attackers learned who worked on wallet infrastructure.
- September: Impostors approached a second engineer through a legitimate job platform. After two interviews, they sent a coding assignment that ran malware on the employee’s work computer. It replaced part of pyenv, contacted an external server and evaded endpoint detection.
- October 20: The attackers used the compromised computer and an internal AI tool to reach two other engineers’ devices. They found a token with permission to deploy containers on the first engineer’s computer.
- October 29: The attackers used the third engineer’s computer and stolen credentials to deploy a container and run a script targeting the wallet signing service.
Why Pausing Withdrawals Wasn’t Enough
On Ethereum, the attackers used signed EIP-7702 authorizations to let their code run from a Binance hot wallet. Ethereum stores the delegation onchain, where it persists until the account clears or replaces it. That let the code keep moving funds after Binance paused withdrawals. Binance cleared the delegation at 00:10 UTC on October 30. Ethereum specification · Onchain analysis
CoinScreamer’s hack timeline traces the initial transfers. The FBI attributed the theft to North Korea’s TraderTraitor operation on October 31 and said investigators had seen attackers convert stolen assets primarily into ether. FBI alert
Binance Plans an Independent Review
Binance reported $2.85 billion frozen or intercepted and said it had replenished 98% of the affected token assets by October 31. It says it rebuilt affected systems and is commissioning an independent review. Response update
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
