The hackers behind Binance’s $6.34 billion theft on October 29 tricked a software engineer through a fake job interview and a coding assignment containing malware. The malicious code replaced a legitimate development component, giving the attackers control of the engineer’s computer and access to two other employees and a deployment authorization token. Using stolen credentials, they reached Binance’s wallet signing service and initiated unauthorized transfers across several blockchains, including 18,270 BTC, approximately 970,500 SOL, 233.46 million XRP and 44.2 million OP. They also exploited Ethereum’s EIP-7702 authorization mechanism to move funds independently of Binance’s withdrawal infrastructure. Approximately $2.85 billion in stolen assets were frozen or intercepted, 98% of affected token assets were replenished as of October 31, and the FBI attributed the theft to North Korea’s TraderTraitor operation, which Pyongyang denied.
Source: Read the original article
