The chain of events behind Binance’s $6.34 billion theft laid bare: it wasn’t a private-key leak, but a four-month-long con set in motion in June when someone “looked for AI tools.”
What we know:
On November 3, Binance released a preliminary report, and the FBI attributed the attack to North Korea’s TraderTraitor.
In June, a wallet engineer installed a tampered version of Homebrew while searching for AI tools.
In September, a second engineer was approached through a fake job offer and downloaded an “onboarding assignment,” letting a zero-day trojan in.
On October 20, the attackers used this computer and an AI tool to steal credentials. At 20:05 UTC on the 29th, they struck, moving 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC within four minutes.
Even worse was the EIP-7702 authorization: the wallet’s “spending rights” were delegated to the attackers’ contract. Suspending withdrawals couldn’t revoke it, and the transfer of 2,961.9 ETH wasn’t finalized until 23:56 UTC.
About $2.85 billion has been frozen, and 98% of the tokens have been replenished.
My take:
The scariest part isn’t the amount—it’s the human vulnerability: the toolchain, recruitment, and AI tools formed a three-part chain, and no alarm went off.
What I’ll do:
I’m watching just two things: whether the third-party review comes out, and whether the new snapshot on November 4 reconciles. If it’s delayed, I’m out.
Pick one: Should exchanges first tighten controls over employee devices, or improve wallet-signing procedures?
$BTC $ETH $SOL
#币安 #HackerAttack
What we know:
On November 3, Binance released a preliminary report, and the FBI attributed the attack to North Korea’s TraderTraitor.
In June, a wallet engineer installed a tampered version of Homebrew while searching for AI tools.
In September, a second engineer was approached through a fake job offer and downloaded an “onboarding assignment,” letting a zero-day trojan in.
On October 20, the attackers used this computer and an AI tool to steal credentials. At 20:05 UTC on the 29th, they struck, moving 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC within four minutes.
Even worse was the EIP-7702 authorization: the wallet’s “spending rights” were delegated to the attackers’ contract. Suspending withdrawals couldn’t revoke it, and the transfer of 2,961.9 ETH wasn’t finalized until 23:56 UTC.
About $2.85 billion has been frozen, and 98% of the tokens have been replenished.
My take:
The scariest part isn’t the amount—it’s the human vulnerability: the toolchain, recruitment, and AI tools formed a three-part chain, and no alarm went off.
What I’ll do:
I’m watching just two things: whether the third-party review comes out, and whether the new snapshot on November 4 reconciles. If it’s delayed, I’m out.
Pick one: Should exchanges first tighten controls over employee devices, or improve wallet-signing procedures?
$BTC $ETH $SOL
#币安 #HackerAttack
