Internal AI Tooling - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/internal-ai-tooling/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 08:57:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBinance: TraderTraitor multi-stage campaign targeting engineering infrastructurehttps://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/Sun, 01 Nov 2026 08:57:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/The North Korean threat actor TraderTraitor compromised multiple Binance engineers through social engineering and supply-chain attacks to infiltrate wallet signing services and drain assets via unauthorized EIP-7702 smart contract delegations.Binance confirmed a sophisticated, multi-stage campaign lasting from June 2026 to late October 2026, attributed to the North Korean threat actor TraderTraitor. The attackers successfully compromised engineering endpoints using trojanized software and fake recruitment schemes. The campaign culminated in the exploitation of internal AI tools and wallet signing services to bypass standard security controls, resulting in the movement of significant cryptocurrency assets. Notably, the attackers established independent persistence on-chain by exploiting Ethereum's EIP-7702 authorization mechanism, which allowed them to delegate hot wallet execution rights to attacker-controlled smart contracts, effectively bypassing standard withdrawal suspension measures.

Attack Chain

  1. Initial access via a compromised, trojanized Homebrew installation on an engineer's laptop.
  2. Reconnaissance of team roles and infrastructure via the compromised endpoint.
  3. Further compromise of a second engineer via social engineering (fake job interviews and malware-laced "assignment" code).
  4. Lateral movement using a compromised internal AI tool to take control of additional engineer devices.
  5. Theft of credentials and access tokens from compromised devices, including a token granting container deployment access.
  6. Unauthorized access to the internal Multi-Party Computation (MPC) wallet signing service.
  7. Execution of 50 signing transactions to establish malicious EIP-7702 on-chain delegations for hot wallets.
  8. Extraction of funds (SOL, OP, BTC) to attacker-controlled addresses, bypassing withdrawal freezes.

Impact

The attackers targeted $6.34 billion in cryptocurrency assets. Binance successfully froze or intercepted $2.85 billion. The campaign involved the unauthorized use of the internal wallet signing service and the exploitation of the EIP-7702 mechanism on-chain.

Recommendation

  • Audit internal development environments for unauthorized modifications to package managers (e.g., Homebrew) and development tool components.
  • Implement strict verification procedures for job recruitment communications, especially those involving external chat applications or requests to execute code from external repositories.
  • Review access control policies for internal AI tooling and container orchestration platforms to enforce least privilege.
  • Implement specialized on-chain monitoring to detect unauthorized delegation or permission changes related to EIP-7702 or similar smart contract authorization mechanisms.
  • Conduct an immediate audit of all active on-chain authorizations for hot wallet services to identify and revoke any unauthorized smart contract delegations.
]]>criticalthreatcryptocurrencyfinancial-crimenation-statesocial-engineeringsupply-chain