Binance: months-long, multistage heist used social engineering, 0-day malware and compromised internal AI tooling
Binance says attackers spent months planning a multistage campaign that combined social-engineering (including fake recruitment interviews), trojanized software (a tampered Homebrew installer), a 0-day malware, and compromise of internal AI tooling to seize access to engineer devices and hot wallets. The attackers targeted $6.34 billion in crypto, and Binance says it froze or intercepted $2.85 billion; the FBI and TRM Security have attributed the operation to North Korean actors. On Oct. 20 the threat actor used a compromised device and an internal AI tool to pivot to other engineer machines, and nine days later executed transfers, leveraging an EIP-7702 authorization to enable on-chain contract execution.