Binance attack traced to multi-month social engineering campaign using fake job interviews and compromised AI coding tool to gain partial hot-wallet access via EIP-7702.
Security & Exploits ·
Binance's investigation into a breach affecting approximately $6.3 billion in digital assets has traced the attack to a coordinated social engineering and software compromise campaign spanning several months. In June, attackers distributed a tampered package through a fake artificial intelligence programming tool; months later, in September, the same group used fraudulent job interview and recruiter tactics to compromise a second employee's device. The exploit leveraged Ethereum's EIP-7702 mechanism, which permits wallets to delegate transaction permissions to smart contracts, granting the attackers partial control over hot-wallet funds and enabling continued unauthorized transfers even after the exchange halted withdrawals.
The architecture of Binance's multiparty computation wallet—designed to distribute signing authority across multiple parties—complicated the exchange's efforts to revoke the permissions the attackers had gained through EIP-7702. The Federal Bureau of Investigation has attributed the attack to North Korean hackers, though this attribution has been disputed by North Korean officials. Binance said it would absorb the losses rather than charge customers and reported that $2.85 billion had been frozen or intercepted, with 98% of affected token assets replenished as of October 31.
The breach underscores a multi-layered attack surface combining software supply-chain tampering with targeted social engineering—vectors that custodians and exchanges may need to systematically evaluate. Details on which specific assets remain at risk or whether additional vulnerabilities enabled the initial compromise remain unclear.