Binance says North Korean hackers reached its wallet signing service through a fake job interview and an internal AI tool

Binance published its first incident report on November 3. It says the theft of about $6.3 billion began with a fake recruitment process. According to BleepingComputer, the attackers gave an engineer a malicious coding assignment and took control of the engineer's work computer. From that machine, with the help of an internal artificial-intelligence (AI) tool, they compromised two engineers on the wallet infrastructure team and took their credentials and a container deployment token. On October 29 they used those credentials to deploy a malicious script that reached the exchange's wallet signing service.

SecurityWeek reports that the attackers also used the signing service to abuse an Ethereum Improvement Proposal (EIP) feature, EIP-7702, which lets an ordinary account hand execution to a smart contract. This gave a contract the attackers controlled partial execution rights over a hot wallet. No contract had a bug. The attack vector was social engineering, followed by a compromise of the systems that hold signing authority. The signing service then approved what an authorized-looking request told it to approve. StepSecurity notes that Binance has not yet disclosed its token permissions, its signing-policy configuration or a full set of host indicators.

The Federal Bureau of Investigation (FBI) attributes the theft to TraderTraitor. CoinDesk describes the North Korean unit as the group behind several of the industry's recent high-profile thefts. The FBI also linked it to the roughly $1.5 billion Bybit theft in February 2025. TRM Labs counted about $6.36 billion leaving Binance wallets on ten blockchains and calls the theft the largest hack in history. North Korea rejects the attribution, according to SecurityWeek. Binance says it set aside about $6.34 billion of company funds to cover customers, and about $2.85 billion had been frozen or intercepted as of November 3, per BleepingComputer.

A smaller breach at Mercado Bitcoin, a Brazilian exchange, shows a similar failure in key management. Mercado Bitcoin announced on November 2 that it had contained an attack. On-chain data from Bitquery shows that 36,042 customer deposit addresses on Ethereum were emptied over the following four hours, as Goku Crypto News reported and CoinDesk confirmed. Bitquery puts total losses at about $48.5 million across ten chains. The exchange has estimated about $36.3 million. The deposit addresses signed the withdrawals themselves, so the attacker held the private keys or a system able to sign for them. No one has publicly attributed the Mercado Bitcoin attack. The exchange plans to restore balance viewing on November 9 and has given no date for withdrawals.