CoinDesk
Binance says North Korea-linked attackers used fake recruitment interviews, malicious developer software and compromised employee devices to infiltrate its systems before exploiting a hot wallet through Ethereum's EIP-7702 mechanism. The exchange puts the hack at $6.3 billion, says $2.85 billion in assets has been frozen and reports that about 98% of affected tokens have been replenished with company funds.
Why it matters
Binance described the intrusion as a campaign built over many months. One engineer was approached through a legitimate job platform, interviewed by people posing as company executives and asked to download a coding assignment containing zero-day malware. Separately, another engineer had installed a tampered Homebrew package while looking for an AI tool.
Attackers used a compromised machine and an internal AI tool to reach wallet engineers' computers on Oct. 20. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC. Binance said its hot wallets use multiparty computation, but that did not allow a single key to revoke the malicious execution permissions. Containment took until 00:10 UTC on Oct. 30.
Market impact
The incident highlights a security risk beyond stolen passwords or compromised signing keys: EIP-7702 permissions were used to authorize execution from a hot wallet outside Binance's normal withdrawal process. The breach also shows how social engineering and infected developer tools can turn employee devices into a route to critical wallet infrastructure.
Binance says users will not be affected and that it will bring in independent cybersecurity experts to review the incident. The exchange also said it blocked 57 suspected North Korea-linked attempts this year. The scale of frozen assets and replenishment will be central to assessing how much of the reported loss is ultimately borne by the company.
Frequently asked questions
-
How did attackers first gain access to Binance employees?
Binance says attackers used fake recruitment interviews, malicious developer software and compromised employee devices. One engineer was tricked into downloading a coding assignment containing zero-day malware.
-
How did EIP-7702 feature in the hot-wallet breach?
Binance said attackers used EIP-7702 to establish malicious execution permissions over a hot wallet, enabling unauthorized transfers outside the exchange's normal withdrawal process.
-
Why did Binance's multiparty-computation setup not stop the attack?
Binance said no single key could revoke the malicious execution permissions. The exchange reported that containment took until 00:10 UTC on Oct. 30.
-
How much of the affected assets has Binance frozen or replenished?
Binance says $2.85 billion in assets has been frozen and about 98% of affected tokens have been replenished with company funds.
-
What security steps did Binance say it would take?
Binance said it will bring in independent cybersecurity experts to review the incident. It also said it blocked 57 suspected North Korea-linked attempts this year.
WatcherGuru
CoinTelegraph
WuBlockchain
CryptoSlate
Lookonchain
Crypto Rank News