JUST IN: Binance froze everything, yet the hackers kept moving the money anyway.
It started with a fake job interview. By the end, North Korea-linked attackers had pulled ~$6.34B in assets.
Here's what happened:
• A multi-stage campaign involving social engineering (fake job interviews), malware on engineer devices, a compromised internal AI tool, and stolen credentials, building on earlier attempts throughout 2026.
• Attackers gained unauthorized access to an internal wallet signing service. They moved large amounts of XRP, SOL, OP, BTC, and ETH, and used Ethereum’s EIP-7702 to set up persistent on-chain authorizations that continued moving funds even after withdrawals were suspended.
• ~$2.85B frozen or intercepted. FBI attributes the attack to North Korea.
• Binance closed entry points, rebuilt affected systems and the wallet environment, replaced devices, revoked credentials, enhanced monitoring and controls.
It started with a fake job interview. By the end, North Korea-linked attackers had pulled ~$6.34B in assets.
Here's what happened:
• A multi-stage campaign involving social engineering (fake job interviews), malware on engineer devices, a compromised internal AI tool, and stolen credentials, building on earlier attempts throughout 2026.
• Attackers gained unauthorized access to an internal wallet signing service. They moved large amounts of XRP, SOL, OP, BTC, and ETH, and used Ethereum’s EIP-7702 to set up persistent on-chain authorizations that continued moving funds even after withdrawals were suspended.
• ~$2.85B frozen or intercepted. FBI attributes the attack to North Korea.
• Binance closed entry points, rebuilt affected systems and the wallet environment, replaced devices, revoked credentials, enhanced monitoring and controls.
