Fake job task and hijacked AI tool in $6.34 billion Binance theft
Original title: North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist
Attackers used a stolen deployment token and EIP-7702 delegation; about $2.85 billion was frozen or intercepted.
The FBI says TraderTraitor stole more than $6 billion from Binance on October 29, 2026; Binance puts the value at about $6.34 billion. A June tampered Homebrew install and a September fake job assignment led to malware that bypassed endpoint tools. On October 29 an attacker used an internal AI tool and a container token to redirect wallet signing, including via Ethereum EIP-7702. Binance says it will absorb the loss and had replaced 98% of impacted tokens by October 31.
Unconfirmed: Binance calls the malware a zero-day; which endpoint product it evaded is not named.
- Five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC on October 29.
- Later transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC.
- Fifty signing transactions matched the wallet nonce; one delegated execution to attacker code.
- At 00:10 UTC on October 30 Binance cleared that delegation by authorizing the zero address.
- Binance says funds came from the SAFU reserve, an insurance fund and company money.
Impact: About $6.34 billion in digital assets moved from Binance wallets
- 1.Do not run interview or assignment code on a work computer.
- 2.Keep deployment tokens off laptops and limit internal AI tool reach.
- 3.Revoke access and rotate keys separately during an incident.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 User Execution: Malicious FileT1078 Valid Accounts
- Vendors
- Binance
- Threat actors
- TraderTraitor
- Malware
- MacSync Stealer
- Victims
- Binance
- Organizations
- FBI
- Countries
- North Korea
From the original article
3 min read at cybersecuritynews.com
North Korean hackers used a fake job interview, a poisoned coding task, and a hijacked internal AI tool to reach Binance’s wallet systems. The FBI says the North Korean group it calls “TraderTraitor” stole more than $6 billion in digital assets on 29 October 2026. Binance puts the impacted value at about USD 6.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.