Binance hack tied fake interviews to wallet signing access

The Binance hack reached the cryptocurrency exchange’s internal wallet signing service. From there, attackers could bypass the normal withdrawal process. Binance’s initial findings, published on November 3, describe a chain that ran for months: a tampered Homebrew installer, a fake recruitment assignment, compromised engineer computers and abuse of an internal AI tool.

The Hacker News’s account of Binance’s findings describes several compromises working together, not one phishing incident doing all the damage.

How did the Binance hack begin?

Binance calls the first target Engineer A, a member of its Wallet DevOps team. While searching online for a popular AI tool, the engineer downloaded a trojanized Homebrew installer. Security Affairs describes the software being sought as an AI coding tool. After Binance detected suspicious activity, it replaced the device and rotated the associated credentials, according to that account.

Those actions addressed the device and credentials, not the disclosure of Engineer A’s role and relationships within the wallet infrastructure team. I’d treat that organizational information as residual damage from the incident, even after credential rotation.

In September, an attacker posing as a Project Director approached Engineer B through a legitimate job-hunting platform. The recruitment process included an interview with an apparent HR representative and then another with someone claiming to be the CEO of a fictitious company.

During the first video interview, the supposed HR representative shared a social media account with personal photos and videos. Those details helped establish credibility. The second interview took place on a popular social chat app. Near the end, Engineer B was told to download a technical assignment onto his work computer.

The assignment contained a malicious repository. Its code ran during setup. The malware replaced a legitimate development-tool component with a poisoned version, executed commands and contacted an attacker-controlled server.

Binance’s endpoint security tools did not detect the malware at the time, Security Affairs reports. The Hacker News also describes obfuscation, evasion and removal of forensic artifacts.

Binance’s AI-tool pivot does not establish a model vulnerability

On October 20, 2026, the attackers used Engineer B’s compromised computer and an internal AI tool to take control of the computers belonging to Engineer A and Wallet Software Engineer C. Security Affairs explicitly notes that the findings do not identify a vulnerability in the AI model itself.

My read is that the critical security boundary was the authority available from the compromised employee environment. The engineering concern is lateral movement from a trusted device, not only the information stored on that device.

The attackers then found a token on Engineer A’s computer with container deployment permissions. On October 29, between 17:15 and 19:56, they accessed Engineer C’s computer and used credentials stolen from Engineer A. Those credentials let them deploy a container and trigger a malicious script.

The attackers ultimately gained unauthorized access to Binance’s internal wallet signing service and initiated transactions outside the normal withdrawal process.

Why did suspending Binance withdrawals fail to stop transfers?

Malicious authorizations were already on-chain, according to Security Affairs, and they operated independently of Binance’s normal withdrawal infrastructure. Suspending withdrawals did not revoke them.

The report describes abuse of Ethereum’s EIP-7702 authorization mechanism. Binance explained that this mechanism allows an account to delegate certain execution rights to a smart contract without exposing its private key. Here, the contract was attacker-controlled. It received partial execution rights over a Binance hot wallet, giving the attacker-controlled contract authority through that delegation.

I’d put authorization revocation beside withdrawal shutdown in a wallet-response plan, rather than assume that shutting down withdrawals contains every form of asset movement.

Binance had to develop a specific procedure to revoke the authorization. Its use of Multi-Party Computation, or MPC, meant there was no single private key that could immediately invalidate the unauthorized permissions, Security Affairs reports. The final unauthorized transfer involved 2,961.9 ETH and was finalized at 23:56 UTC. Binance cleared the malicious authorization at 00:10 UTC on October 30.

Security Affairs reports that five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Other transfers involved approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.

Binance hack loss estimates differ across publishers

Around $2.85 billion had been frozen or intercepted as of Binance’s November 3 update, according to Security Affairs. The same account says Binance would absorb the financial impact. It also reports that Binance had replenished 98% of the affected token assets, based on figures reported on October 31.

The BBC reports that Binance had set aside more than 100% of the funds needed to cover the loss. It also describes a global withdrawal suspension. Once the service reopened, customers withdrew billions of dollars worth of assets.

What Binance rebuilt after the wallet compromise

By its November 3 update, Binance said it had reconstructed the affected wallet system in a new environment. It had also rebuilt the internal AI tool and access controls.

• Endpoint replacement and review: replacing affected devices and completing enhanced security scans across employee devices.
• Credential removal: decommissioning credentials and tokens associated with affected engineers.
• Stronger service and detection controls: tightening device controls, strengthening wallet-service risk controls and expanding AI-based behavioral anomaly detection.
• Asset tracing: working with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.

Binance said it had closed the identified entry points and rebuilt or replaced systems touched along the attack path.

Security Affairs reports that Binance was engaging independent cybersecurity firms. The BBC reports plans to increase investment in AI threat-detection tools, seek to establish a security research fund and work with AI and security firms on targeted initiatives.

Reducing recruitment and AI-tool exposure on developer workstations

The practical controls identified by Security Affairs address technical assignments, deployment credentials and internal AI applications.

1. Run technical assignments in isolated environments. This recommendation applies directly to recruitment repositories whose setup process executes code. Assess the setup process as well as the finished application.
2. Keep deployment credentials short-lived and tightly restricted. Review the permissions available to developer environments, not merely whether the credential belongs to a legitimate employee.
3. Remove unnecessary sensitive-system access from internal AI tools. Security Affairs recommends that these applications never inherit access they do not need. Review effective permissions, not just the model or the interface presented to users.

I’d prioritize these permission and execution boundaries over treating recruiter verification as the entire defense.

For a team evaluating an AI coding agent, I’d include its access to other systems in the adoption decision.

North Korea attribution and Binance’s remaining disclosure gaps

The FBI attributed the incident to the North Korea-linked TraderTraitor group, also tracked as Lazarus Group and APT38, according to Security Affairs. The BBC reports that Binance cited the FBI’s attribution to North Korea. Pyongyang denied involvement.

Binance also said it had detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. Techniques included fraudulent interviews, malicious developer tools, compromised packages and browser extensions, fake video-conferencing applications, and credential-theft or remote-access campaigns.

Security Affairs quotes cybercrime expert Geoff White dating the $1.5b Bybit theft to 2024. The BBC dates the $1.5bn Bybit attack to 2025.