Binance Traces Wallet Attack to Fake Interview and AI Tool Abuse

Binance’s preliminary investigation traces an intrusion into its wallet infrastructure to a fake job interview, malicious code and misuse of an internal AI tool, detailing a path into its wallet-signing systems.

The findings trace the initial compromise to September, when an engineer downloaded a project containing malicious code during a fake job interview. On Oct. 20, attackers used the compromised computer and an internal AI tool to gain access to other wallet engineers’ systems.

On Oct. 29, attackers used stolen credentials to deploy malicious containers and reach Binance’s internal wallet-signing service. They used Ethereum’s EIP-7702 authorization mechanism to grant smart contracts they controlled partial execution rights.

Pausing withdrawals did not immediately revoke the malicious on-chain permissions. The exchange later removed them with a dedicated program.

Binance co-CEO He Yi said the exchange’s security team had identified and blocked 57 suspected North Korea-linked cyber threats in 2026. She also acknowledged that the team failed to prevent a major incident, with serious consequences.