Attackers combined malware, fake job interviews and a Binance internal AI tool in what the company describes as the largest crypto theft to date. Binance’s postmortem traces the attack across several months, starting with a developer’s download in June.
The developer downloaded a tampered installer that appeared to have been distributed through a malicious Google ad. Binance says it exposed details about its engineers and how they worked. The company says its security team detected that installation and replaced the worker’s device.
A fake interview led to another infection
In September, someone posing as a prospective employer targeted another engineer. The person arranged calls and several interview rounds, and shared social media pages to build trust. The engineer was then prompted to download a supposed interview assignment that was malware.
Binance says its security tools missed this second attack. The malware deleted the pyenv executable and replaced it with a malicious version that provided backdoor access. According to the company, the malware used obfuscation and evasion techniques, communicated with an attacker-controlled server and removed traces of the compromise.
By October 20, Binance says, the attackers had used its internal AI tool to gain control over wallets for the engineer targeted in June and a third employee. On October 29, they logged into the third employee’s computer and launched the attack. The FBI has identified the attackers as a North Korean unit called “TraderTraitor.”
Binance explains why transfers continued
Binance says unauthorized transactions continued for nearly two hours after the first transfers because the hot wallet used Multi-Party Computation, or MPC. That meant there was no single private key that could immediately revoke the malicious EIP-7702 authorizations, according to the company.
The postmortem leaves questions about why the fake interview succeeded and how the internal AI tool helped the attackers. The risk of interview assignments that require people to run code on computers with access to employer material has been flagged for years, while Binance provided little detail about the tool’s role.
Binance says it has prevented 57 suspected North Korea-linked cyber threat cases. CEO Richard Teng says no user is bearing the loss and about $2.85 billion in stolen assets has been frozen or intercepted. He said withdrawals had broadly resumed and 98% of impacted tokens had been replenished: “we’re completing the remaining 2%.”
