Binance’s November 3 account says attackers used a fake recruitment process to reach an internal wallet-signing service and authorize cryptocurrency transfers outside the normal withdrawal process. The theft took place on October 29; the company says EIP-7702 delegations then required a separate response from ordinary withdrawal controls. Binance’s initial update describes the sequence.
How Binance says the intrusion reached transaction signing
Binance’s account begins months before the theft. In June 2026, Engineer A installed a tampered Homebrew package. Binance says it detected the anomaly, replaced the device and rotated related credentials, but information about A’s role was later exposed to the attackers.
In September, Engineer B was approached through a legitimate job platform and told to download a malicious code repository disguised as an interview assignment. Binance says attackers later used B’s compromised computer and an internal AI tool to gain control over A and Wallet Software Engineer C. On October 29, they accessed C’s computer, used credentials stolen from A, deployed a container and triggered a malicious script. Binance says this chain reached an internal wallet-signing service, enabling transactions outside normal withdrawals.
This follows NeoTeo’s earlier report on an on-chain link behind the attribution. Binance’s account adds how the company says the intrusion moved from employee devices to transaction signing.
Why the EIP-7702 permissions needed a separate response
Binance says the attackers used Ethereum’s EIP-7702 mechanism to give an attacker-controlled smart contract partial execution rights over a hot wallet. They submitted 50 signing transactions to manipulate the account nonce and establish malicious delegations. Those on-chain permissions operated independently of the ordinary withdrawal system, so suspending withdrawals did not by itself revoke them.
Binance says its hot wallet used multi-party computation, a method that distributes signing across multiple parties rather than relying on one private key. The company said there was no single key that could immediately revoke the delegations, and that clearing them required a specialized procedure. Binance reports that the final unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC on October 29; it cleared the Binance14 delegation at 00:10 UTC on October 30.
What Binance reported about affected and replenished assets
Binance estimated that about $6.34 billion in digital assets were affected. It said about $2.85 billion had been frozen or intercepted, a figure subject to reconciliation and market-price volatility. The two amounts describe different measures.
The company also said it had set aside more than 100% of the funds required to cover the loss and that 98% of impacted token assets had been replenished as of October 31, 2026. Binance called its November 3 account initial and said its investigation and an independent cybersecurity review were continuing.
The FBI’s attribution
In an October 31 alert, the FBI attributed the theft of more than $6 billion in virtual assets to North Korea and called the specific activity TraderTraitor. Binance’s update refers to the FBI’s attribution rather than making a separate direct attribution.
