The original text is in EN, taken from the source site. Source ↗

Binance has revealed that attackers carried out a sophisticated scheme involving fake recruitment interviews, compromised developer endpoints, and malicious blockchain authorizations to steal approximately $6.34 billion in digital assets on October 29, 2026.

The exchange’s initial findings indicate a coordinated intrusion that reached its internal wallet signing service, enabling unauthorized transactions that bypassed normal withdrawal controls. The FBI has linked the theft to North Korea’s TraderTraitor activity cluster.

Binance reported that around $2.85 billion of the stolen assetshad been frozen or intercepted, pending reconciliation and subject to market volatility. The company committed to absorbing the financial impact and stated it had replenished 98% of the affected token assets by October 31.

The attack preparation began months before the theft. In June, a Wallet DevOps engineer downloaded a tampered Homebrew installer while attempting to install an AI coding tool. Binance replaced the device and rotated credentials, but investigators believe the incident exposed the engineer and their colleagues.

Similar fake Homebrew installer campaigns have used convincing websites and manipulated installation commands to compromise macOS systems.

In September, attackers approached another engineer through a legitimate recruitment platform. A supposed project director arranged interviews with individuals impersonating an HR representative and a company CEO.

The first interviewer used live video and a social media account containing personal photographs to establish credibility. During the second interview, the engineer downloaded an assignment repository onto his work computer.

Malicious code executed during setup, replacing the legitimate pyenv component with an altered executable. The script created pyenv_, removed the original binary, renamed the replacement, recreated a symbolic link, and spawned zsh.

On October 20, the attackers used the compromised workstation and an internal AI tool to reach two additional engineers’ computers. They discovered a container deployment permission token on the DevOps engineer’s device.

On October 29, between 17:15 and 19:56 UTC, the intruders accessed another engineer’s computer, used the stolen credentials, deployed a container, and triggered a malicious script.

Unauthorized transfers included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC.

The sequence illustrates how recruitment-driven developer compromises can expose credentials and create routes into privileged infrastructure.

Attackers subsequently abused Ethereum’s EIP-7702 authorization mechanism through the compromised signing service, granting an attacker-controlled contract execution rights over a hot wallet.

These on-chain permissions remained effective after Binance suspended withdrawals. The exchange said attackers submitted 50 signing transactions to manipulate account nonces and establish malicious delegations.

Because the wallet used Multi-Party Computation, responders lacked a single private key for immediate revocation and developed a specialized procedure.

The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the Binance14 delegationat 00:10 UTC on October 30.

Binance rebuilt affected systems, replaced devices, revoked credentials, and strengthened monitoring. Its investigation remains ongoing. The FBI’s attribution notice warns that attackers are converting stolen assets primarily into ETH before laundering them further through decentralized finance and instant-swap services.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.