Binance details massive crypto heist as hackers spend months planning attack

Cryptocurrency exchange Binance has disclosed new details about a massive hack that resulted in billions of dollars in stolen digital assets. According to the company, the threat actors spent months planning the operation, employing sophisticated social engineering and novel malware.

• Hackers targeted a record $6.34 billion, with Binance freezing or intercepting $2.85 billion.
• The attack vector included fake recruitment interviews, compromised Homebrew, and internal AI tools.
• The FBI and TRM Security attributed the heist to North Korean hacking actors known as TraderTraitor.
• Attackers exploited Ethereum's EIP-7702 authorization mechanism to bypass standard withdrawal controls.

Multi-stage campaign and device compromise

Binance's investigation indicates that the campaign began no later than June when an engineer downloaded a tampered version of Homebrew. In September, another engineer was targeted through a legitimate job-hunting platform. Posing as project directors and HR representatives, the attackers conducted multiple video interviews and tricked the employee into downloading an assignment containing malicious code.

On October 20, the attackers used the compromised computer and internal AI tools to take control of other engineers' devices. This granted them unauthorized access to internal wallet signing services, allowing them to initiate large-scale transfers of Solana, Optimism, and Bitcoin to addresses controlled by the hackers.

Authorization bypass and containment efforts

To execute the theft, the threat actors leveraged Ethereum's EIP-7702 mechanism, which grants smart contracts partial execution rights without exposing private keys. Because these authorizations existed independently on-chain, simply suspending withdrawals did not stop all asset movements. Due to Multi-Party Computation (MPC) protocols protecting the hot wallets, revoking these permissions required developing a specialized procedure.

Binance set aside funds to cover the losses and successfully intercepted $2.85 billion in assets by coordinating with industry partners. Meanwhile, TRM Security reported that the attackers laundered the successfully transferred funds using cross-chain bridges and tokens across the TRON and Ethereum networks.

Implications for the crypto industry

This incident marks the largest sum ever targeted in a cryptocurrency theft, highlighting the persistent threat of social engineering against tech personnel. State-sponsored groups increasingly rely on elaborate ruses like fake interviews to breach secure corporate networks. For fintech and crypto platforms, the attack underscores the critical need for rigorous internal access controls and endpoint security.