Binance Says Fake Coding Assignment Helped Enable $6.34 Billion Wallet Heist
Summary
Binance says attackers compromised three engineers’ computers in a months-long campaign, then abused its wallet signing service to steal $6.34 billion. The FBI blamed TraderTraitor; North Korea denied it. Binance says $2.85 billion was frozen or intercepted.
Key points
- Binance’s November 3 report says a months-long campaign compromised three wallet engineers’ computers, including one through a fake job interview and malicious coding assignment.
- The assignment concealed a malicious code repository that substituted a rogue developer-tool component and connected to an attacker-run server; Binance said endpoint tools did not detect the malware.
- Binance says attackers used an internal AI tool on October 20 to gain control of two engineers’ systems, but its report did not explain how the tool was used.
- On October 29, attackers allegedly used credentials taken from one engineer to deploy a container from another engineer’s computer and access Binance’s internal wallet signing service.
- Binance says the attackers moved XRP, SOL, OP and BTC from hot wallets and abused Ethereum’s EIP-7702 mechanism to give an attacker-controlled contract partial execution rights over a hot wallet.
- Binance says it rebuilt the affected wallet system, replaced devices and retired credentials and tokens. Withdrawals broadly resumed in phases; about $2.85 billion was frozen or intercepted.
- The FBI attributed the theft to TraderTraitor, while North Korea denied the attribution. Elliptic said about $3.18 billion remained in theft-linked addresses as of November 3.
Article Details
- Victim Organization
- Binance
- Incident Type
- A months-long intrusion involving social engineering, malicious downloads, compromised employee computers, and unauthorized access to an internal wallet signing service, resulting in cryptocurrency theft.
- Operational Impact
- Binance reported that attackers stole $6.34 billion in assets from hot wallets. Approximately $2.85 billion had been frozen or intercepted, while about $3.18 billion remained in theft-linked addresses as of November 3. Withdrawals were paused and later reopened in phases; Binance said it rebuilt the affected wallet system and replenished 98% of the impacted tokens.
- Claim Status
- confirmed