North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist - CyberSecurityNews

The FBI attributes the massive theft to a North Korean hacking group known as 'TraderTraitor,' which employed sophisticated social engineering and technical exploits. Binance confirmed the breach impacted approximately $6.34 billion in digital assets, marking one of the largest cryptocurrency heists in history.

The attack began in June 2026 when a wallet DevOps engineer unknowingly installed a tampered Homebrew package while searching for an AI coding tool. Despite Binance's immediate response of replacing the device and rotating credentials, the attackers had already identified key personnel working on wallet infrastructure.

Deceptive Recruitment

In September, the hackers targeted a second engineer through a job platform, using a fake 'Project Director' persona. The deception involved two staged interviews with counterfeit HR and CEO representatives. The first interview built trust by referencing personal social media content, while the second required downloading an 'assignment' onto the engineer's work computer.

This approach mirrors previous attacks like WaterPlum, which saw fake recruiters compromise over 30,000 devices, and the TraderTraitor Terraform incident that used fake DevOps tests for infiltration.

Technical Execution

The downloaded malware executed a zero-day attack that replaced a legitimate pyenv file with a malicious version, evading endpoint detection tools. By October 20, the attackers had leveraged this access and an internal AI tool to compromise two additional engineers, one possessing a critical container deployment token.

Between 17:15 and 19:56 UTC on October 29, the attacker used the stolen token to deploy a malicious container. They then exploited Ethereum's EIP-7702 feature to transfer execution rights to a smart contract without revealing private keys, successfully moving 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC.

Response and Recovery

Binance's Multi-Party Computation (MPC) wallet system prevented quick reversal of the compromised delegation. The security team developed a special procedure to clear the delegation by authorizing the zero address at 00:10 UTC on October 30, though this didn't replace the signing key.

The exchange recovered approximately $2.85 billion through freezing and interception, with Binance absorbing the remaining losses. By October 31, 98% of affected tokens had been replaced, as verifiable on their Proof of Reserves page. The exchange has since rebuilt its wallet system, replaced devices, and implemented enhanced security measures including AI-based anomaly detection.