Binance Hack Report Details Fake Job Interview, AI Tool Abuse and EIP-7702 Wallet Drain
Do Son 
| At a glance | |
| Actor | North Korea, according to the FBI as cited by Binance |
| Activity | Social engineering, malware, internal tool abuse, and unauthorized wallet signing |
| Targets | Binance engineers and hot wallets |
| Scale | About USD 6.34 billion in assets affected; USD 2.85 billion frozen, per Binance |
| Status | FBI attribution reported; no arrests or charges announced |
TL;DR
On October 29, 2026, attackers drained Binance hot wallets in a Binance hack that affected about USD 6.34 billion in assets. Binance says the intruders abused an internal signing service and Ethereum’s EIP-7702 feature. The exchange says it will cover all user losses.
What happened
Within four minutes, five hot wallets sent 233.46 million XRP to an attacker address. Solana, Optimism, and Bitcoin wallets followed.
The attacker then abused EIP-7702, which lets an account hand some execution rights to a smart contract. As a result, an attacker contract gained partial control of a hot wallet. Binance says these on-chain permissions “operated independently of Binance’s normal withdrawal infrastructure.” So suspending withdrawals could not stop every transfer. The final unauthorized transfer settled at 23:56 UTC.
Months of preparation
The Binance hack began months earlier. In June, a wallet engineer downloaded a tampered Homebrew installer while setting up an AI coding tool. Then in September, a fake recruiter lured a second engineer into two staged interviews. He was told to download an “assignment” that held malicious code. That malware swapped a developer tool for a rogue copy and evaded endpoint protection.
From that machine, the attacker abused an internal AI tool to reach two more engineers. One held a container deployment token, which the attacker used on October 29.
Who is behind it
According to Binance, the latest FBI information “indicates that the Democratic People’s Republic of Korea is responsible.” Binance also says it blocked 57 suspected North Korea-linked threats in 2026. No individuals have been named or charged.
“It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the FBI said in a statement.
Impact and scale
After the Binance hack, the exchange reports that about USD 2.85 billion has been frozen or intercepted. It also says 98% of the affected token assets were replenished by October 31. These figures come from Binance and remain subject to reconciliation. Details appear in Binance’s initial report on the incident.
What comes next
Binance has rebuilt the wallet system and the AI tool, replaced devices, and revoked related credentials. It is also bringing in outside security firms for an independent review.
- Treat job offers that require running code on a work machine as a red flag.
- Install developer tools only from official sources.
- Limit what internal AI tools and deployment tokens can access.
- Monitor and quickly revoke EIP-7702 delegations on high-value wallets.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
