Binance Details How North Korean Hackers Reached Wallet Signing Access

Binance said Nov. 3 that attackers reached its wallet signing service after using a fake job interview to compromise an engineer, enabling transactions outside the exchange’s normal withdrawal process. The exchange attributed the attack to North Korea.

An engineer downloaded malicious code presented as an interview assignment. Attackers later used that compromised computer and an internal AI tool to reach two other engineers’ computers. Credentials on one of the machines let them deploy a container and gain access to the signing service, which approves wallet transactions.

The attackers used EIP-7702 authorizations on Ethereum to give a smart contract some control over Binance hot wallets. Binance paused withdrawals, but that did not cancel authorizations already recorded onchain. Unauthorized transfers began at 4:05 p.m. ET (20:05 UTC) Oct. 29. The final transfer, 2,961.9 Ether (ETH), completed at 7:56 p.m. ET (23:56 UTC), nearly four hours after the first transfers began.

Binance estimated about $6.34 billion in digital assets were affected and said $2.85 billion had been frozen or intercepted. The company said 98% of affected tokens had been replenished by Oct. 31 and that it would absorb losses rather than pass them to users. Binance said it rebuilt the affected wallet systems and internal AI tool, and plans an independent security review.