{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/binance-wallet/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["TraderTraitor"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Binance","Terraform","internal wallet signing service","internal AI tooling","Binance Wallet"],"_cs_severities":["critical"],"_cs_tags":["cryptocurrency","financial-crime","nation-state","social-engineering","supply-chain"],"_cs_type":"threat","_cs_vendors":["Binance","HashiCorp"],"content_html":"\u003cp\u003eBinance confirmed a sophisticated, multi-stage campaign lasting from June 2026 to late October 2026, attributed to the North Korean threat actor TraderTraitor. The attackers successfully compromised engineering endpoints using trojanized software and fake recruitment schemes. The campaign culminated in the exploitation of internal AI tools and wallet signing services to bypass standard security controls, resulting in the movement of significant cryptocurrency assets. Notably, the attackers established independent persistence on-chain by exploiting Ethereum's EIP-7702 authorization mechanism, which allowed them to delegate hot wallet execution rights to attacker-controlled smart contracts, effectively bypassing standard withdrawal suspension measures.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access via a compromised, trojanized Homebrew installation on an engineer's laptop.\u003c/li\u003e\n\u003cli\u003eReconnaissance of team roles and infrastructure via the compromised endpoint.\u003c/li\u003e\n\u003cli\u003eFurther compromise of a second engineer via social engineering (fake job interviews and malware-laced \u0026quot;assignment\u0026quot; code).\u003c/li\u003e\n\u003cli\u003eLateral movement using a compromised internal AI tool to take control of additional engineer devices.\u003c/li\u003e\n\u003cli\u003eTheft of credentials and access tokens from compromised devices, including a token granting container deployment access.\u003c/li\u003e\n\u003cli\u003eUnauthorized access to the internal Multi-Party Computation (MPC) wallet signing service.\u003c/li\u003e\n\u003cli\u003eExecution of 50 signing transactions to establish malicious EIP-7702 on-chain delegations for hot wallets.\u003c/li\u003e\n\u003cli\u003eExtraction of funds (SOL, OP, BTC) to attacker-controlled addresses, bypassing withdrawal freezes.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe attackers targeted $6.34 billion in cryptocurrency assets. Binance successfully froze or intercepted $2.85 billion. The campaign involved the unauthorized use of the internal wallet signing service and the exploitation of the EIP-7702 mechanism on-chain.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit internal development environments for unauthorized modifications to package managers (e.g., Homebrew) and development tool components.\u003c/li\u003e\n\u003cli\u003eImplement strict verification procedures for job recruitment communications, especially those involving external chat applications or requests to execute code from external repositories.\u003c/li\u003e\n\u003cli\u003eReview access control policies for internal AI tooling and container orchestration platforms to enforce least privilege.\u003c/li\u003e\n\u003cli\u003eImplement specialized on-chain monitoring to detect unauthorized delegation or permission changes related to EIP-7702 or similar smart contract authorization mechanisms.\u003c/li\u003e\n\u003cli\u003eConduct an immediate audit of all active on-chain authorizations for hot wallet services to identify and revoke any unauthorized smart contract delegations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T17:09:21Z","date_published":"2026-11-01T08:57:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/","summary":"The North Korean threat actor TraderTraitor compromised multiple Binance engineers through social engineering and supply-chain attacks to infiltrate wallet signing services and drain assets via unauthorized EIP-7702 smart contract delegations.","title":"Binance: TraderTraitor multi-stage campaign targeting engineering infrastructure","url":"https://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/"}],"language":"en","title":"CraftedSignal Threat Feed - Binance Wallet","version":"https://jsonfeed.org/version/1.1"}