Binance Post-Mortem Traces $6.3B Wallet Heist to Fake Job Offer

Summary

Binance’s initial post-mortem traces a wallet incident affecting $6.34B in assets to a tampered developer-tool install and a fake job assignment that enabled access to its wallet-signing service.

Key points

In June, a tampered Homebrew installation affected one Binance engineer’s device. Binance detected the anomaly, replaced the device and rotated credentials, but the attacker reportedly learned team information.
In September, another engineer ran a coding assignment that replaced pyenv with a doctored copy connected to an attacker-controlled server; endpoint protection did not detect it.
According to Binance, the attacker used that engineer’s machine and an internal AI tool to access two other engineers’ computers, finding a container-deployment token on one. Binance has not explained how the AI tool enabled access and says it rebuilt the tool and its access controls.
On October 29, the attacker reportedly used stolen credentials to deploy a container and malicious script, reaching Binance’s internal wallet-signing service. Binance said no wallet was cracked and it found no evidence that a private key leaked.
About 50 transactions included on-chain delegations that let an attacker-controlled contract act on Binance hot wallets. Suspending withdrawals did not revoke those permissions; Binance said its MPC setup complicated signing a revocation.
Binance reported about $6.34 billion in impacted assets and $2.85 billion frozen or intercepted. It replenished 98% of affected tokens with its own funds by October 31; the stolen funds were not recovered, and withdrawals reopened gradually from November 1.
The FBI attributes the theft to TraderTraitor, a North Korean operation; North Korea denies it. Binance described its post-mortem as initial, with some details still unpublished.

Article Details

Victim Organization: Binance
Incident Type: Social engineering through a fraudulent job offer, followed by malware execution, credential theft, lateral movement, and unauthorized cryptocurrency transfers through Binance's wallet-signing service.
Operational Impact: Approximately $6.34 billion in assets were impacted. Binance reported that about $2.85 billion was frozen or intercepted; stolen funds were not recovered. Binance replenished 98% of affected tokens from its own funds by October 31. Withdrawals were suspended and reopened gradually from November 1.
Claim Status: confirmed