Binance disclosed Tuesday that hackers targeted $6.34 billion in cryptocurrency through a months-long campaign combining social engineering, malware, and compromised internal systems. The FBI and TRM Security attribute the theft to North Korean actors operating under the name TraderTraitor.
The attackers began work no later than June. In one early phase, an engineer downloaded a compromised version of Homebrew that infected his laptop. In September, a separate engineer received a fake job interview offer through a legitimate job-hunting platform. The purported HR representative and CEO conducted interviews over video and chat, eventually sending the engineer an "assignment" containing malicious code that executed during setup.
On October 20, attackers used the compromised devices and an internal AI tool to access a third engineer's computer and steal a credential granting wallet access. Nine days later, between 17:15 and 19:56 UTC, the threat actor deployed a container and initiated transfers. Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker addresses. The attackers also transferred 18,270 BTC from a Binance hot wallet.
The attackers then exploited Ethereum's EIP-7702 authorization mechanism to delegate execution rights to a smart contract, bypassing normal withdrawal processes. Binance detected the activity through internal alerts and suspended withdrawals, coordinating with partners to freeze $2.85 billion in total assets.
Revocation required technical work because the wallet used Multi-Party Computation without a single private key. Binance developed a specialized procedure to revoke the on-chain authorizations.
TRM said attackers laundered transferred assets through TRON and Ethereum using a self-minted token, liquidity pools, lending receipt tokens, and cross-chain swaps.
Binance said it has set aside funds to cover the loss and provided a Proof of Reserves page.