Binance Engineer Duped by North Korean Hackers’ “Fake Interview”! Inside the $6.3 Billion Theft
On November 3, Binance published a preliminary investigation report into the October 29 security incident, revealing how North Korean hackers infiltrated the wallet-signing process in multiple stages using fake job recruitment, malware, and compromised internal AI tools, stealing approximately $6.34 billion in assets. By the time the report was published, $2.85 billion had been frozen, and 98% of affected tokens had been replenished.
The serious security incident was orchestrated by the Democratic People’s Republic of Korea (DPRK). The attackers used employee interviews, malware, and compromised internal AI tools to gradually take control of multiple employees’ devices, ultimately gaining wallet-signing permissions. They then bypassed the normal withdrawal process using Ethereum’s EIP-7702 authorization mechanism and stole approximately $6.34 billion worth of crypto assets. Binance said the platform would fully cover the losses. By the time the report was published, approximately $2.85 billion in assets had been frozen or intercepted, and 98% of affected token assets had been replenished.
How $6.3 Billion Was Moved
Binance’s report also reconstructed the timeline of the attack on October 29. Between 20:05 and 20:09 UTC, five of Binance’s hot wallets transferred 233.46 million XRP to addresses controlled by the attackers. Hot wallets deployed on the Solana and Optimism networks subsequently transferred approximately 970,500 SOL and 44.2 million OP, respectively. Binance launched an investigation immediately after receiving an internal alert, but the attackers continued their operation, transferring another 18,270 BTC from a hot wallet.
The key to the attack was the abuse of Ethereum’s EIP-7702 authorization mechanism. This mechanism allows an account to delegate some execution permissions to a smart contract without exposing its private key. The attackers exploited it to give a smart contract under their control partial execution permissions over one of Binance’s hot wallets. They submitted 50 signed transactions, manipulating the account’s nonce to create malicious delegated authorizations.
These authorizations existed on-chain, independently of Binance’s normal withdrawal infrastructure. As a result, the attackers could continue transferring assets even after Binance suspended withdrawals.
The Binance team had to initiate additional transactions to revoke these on-chain authorizations. However, because the hot wallets involved used multi-party computation (MPC) technology, there was no single private key that could be used to revoke them immediately. The team had to specifically develop and execute.#币安10·30安全事件调查报告 #Binance to Resume Withdrawals of More Assets
On November 3, Binance published a preliminary investigation report into the October 29 security incident, revealing how North Korean hackers infiltrated the wallet-signing process in multiple stages using fake job recruitment, malware, and compromised internal AI tools, stealing approximately $6.34 billion in assets. By the time the report was published, $2.85 billion had been frozen, and 98% of affected tokens had been replenished.
The serious security incident was orchestrated by the Democratic People’s Republic of Korea (DPRK). The attackers used employee interviews, malware, and compromised internal AI tools to gradually take control of multiple employees’ devices, ultimately gaining wallet-signing permissions. They then bypassed the normal withdrawal process using Ethereum’s EIP-7702 authorization mechanism and stole approximately $6.34 billion worth of crypto assets. Binance said the platform would fully cover the losses. By the time the report was published, approximately $2.85 billion in assets had been frozen or intercepted, and 98% of affected token assets had been replenished.
How $6.3 Billion Was Moved
Binance’s report also reconstructed the timeline of the attack on October 29. Between 20:05 and 20:09 UTC, five of Binance’s hot wallets transferred 233.46 million XRP to addresses controlled by the attackers. Hot wallets deployed on the Solana and Optimism networks subsequently transferred approximately 970,500 SOL and 44.2 million OP, respectively. Binance launched an investigation immediately after receiving an internal alert, but the attackers continued their operation, transferring another 18,270 BTC from a hot wallet.
The key to the attack was the abuse of Ethereum’s EIP-7702 authorization mechanism. This mechanism allows an account to delegate some execution permissions to a smart contract without exposing its private key. The attackers exploited it to give a smart contract under their control partial execution permissions over one of Binance’s hot wallets. They submitted 50 signed transactions, manipulating the account’s nonce to create malicious delegated authorizations.
These authorizations existed on-chain, independently of Binance’s normal withdrawal infrastructure. As a result, the attackers could continue transferring assets even after Binance suspended withdrawals.
The Binance team had to initiate additional transactions to revoke these on-chain authorizations. However, because the hot wallets involved used multi-party computation (MPC) technology, there was no single private key that could be used to revoke them immediately. The team had to specifically develop and execute.#币安10·30安全事件调查报告 #Binance to Resume Withdrawals of More Assets
