# Binance says North Korean hackers reached its wallet signing service through a fake job interview and an internal AI tool

The FBI blames the TraderTraitor unit for the $6.3 billion theft, and in the same week Mercado Bitcoin customer deposit addresses kept draining for four hours after the Brazilian exchange said its own breach was contained.

- Published: 2026-11-06T09:52:06.667Z
- Canonical: https://polylog.news/crypto/2026-11-06/binance-says-north-korean-hackers-reached-its-wallet-signing
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/business/2026/11/05/what-is-tradertraitor-the-hacking-squad-behind-the-usd6-3-billion-binance-heist), [Polylog editors](https://polylog.news)

Binance published its first incident report on November 3. It says the theft of about $6.3 billion began with a fake recruitment process. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/), the attackers gave an engineer a malicious coding assignment and took control of the engineer's work computer. From that machine, with the help of an internal artificial-intelligence (AI) tool, they compromised two engineers on the wallet infrastructure team and took their credentials and a container deployment token. On October 29 they used those credentials to deploy a malicious script that reached the exchange's wallet signing service.

[SecurityWeek](https://www.securityweek.com/rigged-coding-assignment-abused-ai-tool-opened-path-to-6-billion-binance-heist/) reports that the attackers also used the signing service to abuse an Ethereum Improvement Proposal (EIP) feature, EIP-7702, which lets an ordinary account hand execution to a smart contract. This gave a contract the attackers controlled partial execution rights over a hot wallet. No contract had a bug. The attack vector was social engineering, followed by a compromise of the systems that hold signing authority. The signing service then approved what an authorized-looking request told it to approve. [StepSecurity](https://www.stepsecurity.io/blog/binance-hack-developer-machine-security) notes that Binance has not yet disclosed its token permissions, its signing-policy configuration or a full set of host indicators.

The Federal Bureau of Investigation (FBI) attributes the theft to TraderTraitor. [CoinDesk](https://www.coindesk.com/business/2026/11/05/what-is-tradertraitor-the-hacking-squad-behind-the-usd6-3-billion-binance-heist) describes the North Korean unit as the group behind several of the industry's recent high-profile thefts. The FBI also linked it to the roughly $1.5 billion Bybit theft in February 2025. [TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) counted about $6.36 billion leaving Binance wallets on ten blockchains and calls the theft the largest hack in history. North Korea rejects the attribution, according to SecurityWeek. Binance says it set aside about $6.34 billion of company funds to cover customers, and about $2.85 billion had been frozen or intercepted as of November 3, [per BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/).

A smaller breach at Mercado Bitcoin, a Brazilian exchange, shows a similar failure in key management. Mercado Bitcoin announced on November 2 that it had contained an attack. On-chain data from Bitquery shows that 36,042 customer deposit addresses on Ethereum were emptied over the following four hours, [as Goku Crypto News reported](https://t.me/GokuCryptoNews/21235) and [CoinDesk confirmed](https://www.coindesk.com/business/2026/11/05/mercado-bitcoin-hack-continued-hours-after-exchange-said-attack-was-contained-report-finds). [Bitquery](https://bitquery.io/investigations/mercado-bitcoin-hack) puts total losses at about $48.5 million across ten chains. The exchange has estimated about $36.3 million. The deposit addresses signed the withdrawals themselves, so the attacker held the private keys or a system able to sign for them. No one has publicly attributed the Mercado Bitcoin attack. The exchange plans to restore balance viewing on November 9 and has given no date for withdrawals.

## What this means

Both thefts went through the people and machines that hold signing authority, which code audits do not cover. The losses fall on exchange balance sheets, on customers of venues that lack Binance's capital, and on stablecoin issuers and lenders now asked to freeze stolen funds. The Bybit theft is the closest precedent. Bybit covered customers, kept operating, and most of the stolen funds were laundered before anyone could freeze them. Binance's $2.85 billion in early freezes is a different outcome, and the main reason is how much of the stolen value sat in tokens whose issuers can freeze them. The consensus treats this as an exchange-specific failure. The evidence points instead to a repeatable playbook: fake hiring processes, compromised developer machines and signing services that trust deployed code. The likelier outcome is that within months the large exchanges move signing behind hardware-isolated policy engines, restrict EIP-7702 delegations from hot wallets, and give insurers and auditors scope over developer laptops. That depends on Binance publishing enough detail for peers to copy its fixes. The read is wrong if another exchange loses a nine-figure sum through the same developer-machine route before year end.

## What to watch

- Whether Binance publishes its full signing-policy configuration and host indicators, because peer exchanges need them to check whether the same path is open in their own systems.
- How much of the frozen $2.85 billion becomes recoverable, which will show whether issuer freezes are now a dependable defense against state-backed thieves.
- Whether Mercado Bitcoin confirms that its deposit keys came from a single master key, because that design would leave other customer addresses exposed until the keys are rotated.