NEWS · COMPANIES · #3073
Binance: months-long, multistage heist used social engineering, 0-day malware and compromised internal AI tooling
Binance says attackers spent months planning a multistage campaign that combined social-engineering (including fake recruitment interviews), trojanized software (a tampered Homebrew installer), a 0-day malware, and compromise of internal AI tooling to seize access to engineer devices and hot wallets. The attackers targeted $6.34 billion in crypto, and Binance says it froze or intercepted $2.85 billion; the FBI and TRM Security have attributed the operation to North Korean actors. On Oct. 20 the threat actor used a compromised device and an internal AI tool to pivot to other engineer machines, and nine days later executed transfers, leveraging an EIP-7702 authorization to enable on-chain contract execution.
KEY POINTS
- Binance says attackers spent months planning a multistage campaign that combined social-engineering (including fake recruitment interviews), trojanized software (a tampered Homebrew installer), a 0-day malware, and compromise of internal AI tooling to seize access to engineer devices and hot wallets.
- The attackers targeted $6.34 billion in crypto, and Binance says it froze or intercepted $2.85 billion; the FBI and TRM Security have attributed the operation to North Korean actors.
- 20 the threat actor used a compromised device and an internal AI tool to pivot to other engineer machines, and nine days later executed transfers, leveraging an EIP-7702 authorization to enable on-chain contract execution.
WHY IT MATTERS
The incident is the largest known targeted crypto theft and shows attackers can abuse internal AI tooling and novel malware to bypass traditional protections, raising urgent AI and infrastructure security concerns.