Binance: Security Incident Involving Compromised Engineering Systems
Binance reported a theft of $6.34 billion following a months-long campaign involving the compromise of three engineers' computers through a tampered software installation and a fake job recruitment process. The FBI has attributed the activity to the North Korean state-sponsored group TraderTraitor.
Triage facts
Revision 1- Evidence
- Confirmed activeHigh confidence
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 11:00 UTC
- Source quality
- A2Likely
Binance identified that attackers gained access to wallet signing systems via a campaign targeting its engineering staff. The intrusion utilized:
- A tampered Homebrew installation downloaded by an engineer seeking an AI coding tool.
- A fraudulent job recruitment process targeting a second engineer, which involved a fake HR representative and the delivery of a malicious coding assignment.
- Use of an internal AI tool by attackers to gain control over systems belonging to other engineers.
Attackers exploited unauthorized access to an internal wallet signing service to move assets and abused the Ethereum EIP-7702 mechanism to gain partial execution rights over hot wallets. Approximately $2.85 billion of the stolen assets have been frozen or intercepted.