Overview
- Binance says attackers used compromised internal signing systems to move funds on Oct. 29 after a rapid sequence of transfers that began a months‑long intrusion.
- The company’s report traces the campaign to June and shows attackers used a tampered Homebrew installer, fake job interviews with a rigged coding assignment and a compromised internal AI tool to gain access to engineers’ machines.
- Technically, the attackers abused Ethereum’s EIP‑7702 delegation feature and Binance’s MPC‑based hot‑wallet signing setup, which kept malicious authorizations active on‑chain and made immediate revocation difficult.
- Binance and partners say roughly $2.85 billion of the stolen tokens were frozen or intercepted, the exchange has resumed phased withdrawals, and Binance reports it has replenished about 98% of affected token balances from company reserves.
- Law enforcement has attributed the theft to a DPRK‑linked unit dubbed TraderTraitor, blockchain firms trace about $3.18 billion still in theft‑linked addresses, recent deposits into the Privacy Cash mixer show ongoing laundering, and independent reviews and cross‑industry fixes are under way