Binance Initial Findings: Fake Interview to Wallet Signing Service

~$6.34B impacted and ~$2.85B "frozen or intercepted, subject to reconciliation and market price volatility", per Binance (claimed; all chains). Binance says 98% of impacted token assets were replenished as of 31 Oct.

Root cause: Claimed (Binance): a multi-stage campaign. A tampered Homebrew installer (June) exposed the wallet team; a fake-interview "assignment" repo (September) ran 0-day malware on an engineer's work computer; an internal AI tool (20 Oct) was used to reach two wallet engineers; a container deployment token found on one machine was used on 29 Oct to deploy a container and run the attack script against the wallet signing service. This replaces Binance's earlier "compromised DevOps engineer's laptop" account.

Timeline, as sourced: Per Binance: attacker on Engineer C's computer 29 Oct 17:15 to 19:56 (zone not stated; the report gives later times in UTC); XRP outflows 20:05 to 20:09 UTC; final unauthorized transfer, 2,961.9 ETH, finalised 23:56 UTC; delegation cleared 30 Oct 00:10 UTC. FBI alert 31 Oct. Report published 3 Nov 14:33 UTC.

Claimed (Binance) (Initial Findings (opens in a new tab)): "The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process." Binance lists 233.46 million XRP sent from five hot wallets between 20:05 and 20:09 UTC; approximately 970,500 SOL and 44.2 million OP from hot wallets on Solana and Optimism; and 18,270 BTC from a hot wallet.

Claimed (Binance): on Ethereum the attacker used the signing service to exploit EIP-7702, submitting "50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations." Because the hot wallet used Multi-Party Computation, "there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations", and suspending withdrawals did not invalidate them. This matches the 50 authorizations NullMeridian traced on-chain in the 29 Oct entry.

Claimed (Binance), attack preparation: June 2026, Engineer A (Wallet DevOps) downloaded "a tampered Homebrew installation" found via a search engine; the device was replaced and credentials rotated, but the wallet team was exposed. September, Software Engineer B was approached on a job-hunting platform, interviewed by video, then told to download an "assignment" repository onto his work computer; it replaced a pyenv component with a malicious version. 20 October, the attacker used Engineer B's computer and an internal AI tool to gain control over Engineers A and C, and found a container deployment permission token on Engineer A's computer. 29 October, the attacker logged onto Engineer C's computer, used Engineer A's credentials, deployed a container and triggered a malicious script.

Claimed (Binance): its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026. Binance says entry points are closed, the wallet system and the AI tool were rebuilt, and independent security firms are being engaged. Some technical details will remain confidential.

Attribution. Claimed (FBI) (alert (opens in a new tab), 31 Oct): the DPRK "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026"; the FBI calls the activity "TraderTraitor" and lists addresses holding or having held stolen assets. Binance's report cites the FBI finding.

Claimed (DPRK, via KCNA): in a statement dated 2 Nov (KCNA (opens in a new tab)), Kim Yo Jong calls the U.S. assertion "an absurd rhetoric and nothing new". In a second statement dated 4 Nov (KCNA (opens in a new tab)) she says: "We do not regard the ‘Binance’ hacking incident as any accidental and sudden case or isolated private scheme, but as an extension of Washington's invariable hostile policy toward the DPRK." (inner quotation marks rendered as single quotes). The second statement does not repeat the denial.

Unknown: the technical detail Binance is withholding; the outcome of the independent review; how the $2.85B frozen figure breaks down by chain and issuer.