Fake Recruitment Phishing? Binance Discloses Full Chain of North Korea-Linked Attack

The original text is from Binance Official

On October 29, 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened. We deeply apologize for the concern, impact, and uncertainty this incident has caused to our users, partners, and the entire industry.

Protecting our users is our foremost responsibility. The financial impact of the stolen funds will be borne by Binance and will not be passed on to users. We have set aside more than 100% of the loss amount to cover the losses. As of October 31, 2026, 98% of the affected token assets have been replenished and can be verified on our Proof of Reserves page. We are purchasing the remaining assets that have not yet been replenished and have lower liquidity.

This incident affected approximately $6.34 billion in digital assets. As of this update, approximately $2.85 billion in digital assets have been frozen or intercepted; the specific amount is still subject to verification and may be affected by market price fluctuations.

We immediately took action to contain the incident and strengthen the relevant systems. The entry point confirmed to have been exploited in this attack has been closed. The systems involved in the attack path have been rebuilt or replaced. We have also implemented stricter device controls, strengthened wallet service risk controls, and expanded AI-based behavioral anomaly detection.

This is our preliminary report, detailing the information we currently have and the improvements already completed. The investigation is still ongoing, and our findings will be subject to further independent review. To prevent malicious actors from using relevant information to plan attacks, some technical details will remain confidential. We are inviting independent security firms to conduct further review.

The latest information released by the FBI indicates that the Democratic People's Republic of Korea is responsible for this incident.

We are publishing this preliminary report because collective learning across the industry helps improve security.

What Happened on October 29

The attack spread rapidly across multiple networks.

The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to addresses controlled by the attacker.

Binance hot wallets on Solana and Optimism transferred approximately 970,500 SOL and 44.2 million OP to addresses controlled by the attacker.

Subsequently, Binance received an internal alert regarding a large transfer and immediately launched an investigation.

Binance hot wallets transferred 18,270 BTC to addresses controlled by the attacker.

The attacker then exploited the signing service to abuse Ethereum's EIP-7702 authorization mechanism. EIP-7702 allows accounts to delegate certain execution permissions to smart contracts without exposing private keys. In this case, the attacker used this mechanism to grant partial execution permissions over Binance hot wallets to a smart contract they controlled.

Binance immediately initiated multiple containment measures, including suspending withdrawals to limit further asset outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts collectively froze $2.85 billion worth of assets.

However, suspending withdrawals alone could not prevent all unauthorized asset transfers. The malicious EIP-7702 authorization already existed on-chain and operated independently of Binance's normal withdrawal infrastructure. The attacker submitted 50 signed transactions to manipulate account nonces and establish malicious delegation authorizations. Once the authorizations were established, the attacker could continue transferring assets independently of Binance's normal withdrawal infrastructure. Binance needed to revoke these on-chain authorizations through additional transactions.

The containment process also involved other technical complexities. Because the hot wallet uses multi-party computation (MPC), there is no single private key that could be used to immediately revoke the malicious EIP-7702 authorization. Therefore, the team developed and executed a dedicated revocation process, which required additional time. In addition, suspending withdrawals and shutting down hot wallet services does not automatically invalidate existing on-chain authorizations.

These challenges extended the time required to fully contain the unauthorized asset transfers. We are reviewing our incident response processes, signing policy coverage, and hot wallet controls, and looking for opportunities to further enhance our ability to respond quickly to threats in the future.

The last unauthorized transfer involved 2,961.9 ETH and was completed on-chain at 23:56 UTC. The transaction had previously been broadcast and was in a pending state before being finally confirmed. No further unauthorized transfers have been observed since then.

At 00:10 UTC on October 30, 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.

Attack Preparation

Our current investigation indicates that this was a sophisticated, multi-stage operation, not a single isolated security breach or a simple phishing incident. The attacker combined multiple techniques, including social engineering through fake job interviews, downloading malware, compromising internal AI tools, compromising endpoints, and employing advanced transaction authorization methods.

• June 2026 — Supply Chain Attack. Engineer A from Wallet DevOps searched for a popular AI coding tool on a search engine and downloaded a tampered Homebrew installer to install the tool. After our security team detected the anomaly, we replaced the device and rotated all related credentials as a proactive security measure. However, the identity of Engineer A and information about his colleagues on the wallet infrastructure team had been exposed to the hackers.
• Throughout 2026, the Binance security team detected and blocked 57 suspected cyber threat incidents linked to North Korea. These attacks reflect the persistent threat that state-sponsored actors pose to the cryptocurrency industry. The methods they use include fake job interviews, malware disguised as popular development tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.
• September 2026 — Social Engineering Attack. Software Engineer B was contacted through a legitimate job platform by someone claiming to be a project director. Software Engineer B's profile on the platform mentioned his work experience at Binance. The person claiming to be a project director arranged a first-round interview hosted by someone claiming to be an HR representative, followed by a second-round interview with someone claiming to be the CEO of a fictitious company.
• During the first-round interview, the person claiming to be an HR representative conducted a live video interview with Software Engineer B. To build trust, the interviewer shared their social media accounts, which contained personal photos and videos posted on the platform. This tactic was more sophisticated and deceptive than previously observed social engineering attacks.
• The second-round interview was conducted on a popular social chat application. Near the end of the interview, Engineer B was asked to download a "homework assignment" containing a malicious code repository onto his work computer. The malicious code in the repository executed during setup and began a series of unauthorized activities.
• The malware employed sophisticated obfuscation and evasion techniques, including replacing legitimate development tool components with malicious versions to execute commands and establish communication with external servers controlled by the attacker. At the time, endpoint security protection tools failed to detect this zero-day malware. The attacker also took steps to conceal malicious activity and erase traces of intrusion, making detection and subsequent investigation more challenging.
• The script used obfuscation techniques to evade security detection and executed the following steps.

Create /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_

Modify pyenv_ → 3,414 B

Delete .../libexec/pyenv (3,344 B) ← Remove the valid pyenv

Rename pyenv_ → pyenv (3,414 B) ← Replace with the malicious version

Delete /opt/homebrew/bin/pyenv (3,414 B)

ln (create a new symbolic link) + launch zsh

• October 20, 2026 — Using Internal AI Tools as a Springboard. The attacker used Engineer B's compromised computer to take control of Wallet DevOps Engineer A and another wallet software engineer, Engineer C, through internal AI tools. The attacker quickly discovered that Wallet DevOps Engineer A's computer had a container deployment permission token.
• October 29, 2026 — Breaching Wallet Signing Operations. Between 17:15 and 19:56 on October 29, the attacker logged into Software Engineer C's computer, used credentials stolen from Wallet DevOps Engineer A to deploy a container, and triggered a malicious script to launch the attack.

Measures We Have Taken

As of November 3, 2026, we have taken the following measures:

• Rebuilt the affected wallet systems in a new environment.
• Rebuilt the affected internal AI tools and strengthened access controls.
• Replaced the affected devices.
• Disabled the relevant credentials and tokens of the affected engineers.
• Completed enhanced security scans of all employee devices.
• Strengthened AI-based behavioral anomaly detection.
• Strengthened wallet service risk controls.
• Worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze the affected assets.

We will continue to strengthen all measures as the investigation progresses. We have implemented and are implementing multiple security measures. To prevent malicious actors from using relevant information to undermine our security, some of these measures will remain confidential.

Next Steps

We are immediately taking the following measures.

1. Independent Cybersecurity Review

We are inviting independent third-party cybersecurity experts to conduct a comprehensive review of this incident, verify our investigation findings, and propose additional measures. The scope and results of the review will inform our ongoing remediation efforts.

2. Increased Investment in AI Security and Prevention

We are increasing investment in AI-powered detection, endpoint protection, development environment security, and behavioral anomaly monitoring.

3. Security Research Fund and Industry Initiatives

We are working with leading AI companies, industry participants, and security firms to establish a security research fund and launch dedicated initiatives focused on AI security in the blockchain context.

We will continue to proactively share the latest information.