Binance / TraderTraitor - Fake Job Interview → Swapped pyenv on a Work Computer → Internal AI Tool Reaches Two More Engineers → Container Deployed With a Stolen Token → Wallet Signing Service Signs the Drain
Binance published its initial findings on November 3, 2026, five days after about $6.3 billion in digital assets left its hot wallets. It presents the account as what its current investigation indicates, with findings subject to further independent review. In June a wallet DevOps engineer downloaded a tampered Homebrew installation. In September a fake job interview put malware on a second engineer's work computer. On October 20 the attacker used an internal AI tool to gain control over two more engineers, and found a container deployment token on one of their computers. On October 29 the attacker used that engineer's stolen credentials to deploy a container and trigger a script, and reached an internal wallet signing service to start transactions outside the normal withdrawal process. The FBI attributes the theft to North Korea's TraderTraitor. Three caveats belong next to the headline. Binance has not said where the container ran, what the internal AI tool does, or how the container reached the signing service. Each loss figure measures something different, so every figure on this page names its source. And Binance's first update pointed to a compromised DevOps engineer's laptop, while the November account describes a campaign that began months earlier, with a tampered installer in June and a fake job interview in September.
Binance says an engineer on its Wallet DevOps team, whom it calls Engineer A, searched for a popular AI coding tool on a search engine and downloaded a tampered Homebrew installation to install it. Binance's security team detected the anomaly, replaced the device and rotated all related credentials. Binance says the engineer's role, and his colleagues on the wallet infrastructure team, had still been exposed to the attacker.
Binance does not name the tool or say how the tampered installer was delivered. As its reference for a tampered Homebrew installation it links a SANS Internet Storm Center diary from May, which describes a malicious search ad leading to a fake Homebrew page that asked visitors to paste a script into Terminal, installing the MacSync Stealer. The diary does not mention Binance, and Binance does not say its engineer reached that page. Binance calls the whole operation one multi-stage campaign but does not separately say that the June and September compromises were the same attacker.
Who: Wallet DevOps Engineer A
How: a tampered Homebrew installation, found through a search engine
Response: device replaced, related credentials rotated
Still exposed: the engineer's role and his wallet infrastructure colleagues, per Binance
Binance says Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director, and that his profile there referenced his experience at Binance. The purported Project Director arranged a first-round live video interview with an HR representative, who shared a social media account with personal photos and videos to build trust, and then a second round with someone claiming to be the CEO of a fictitious company. Binance does not name the platform or the company.
BleepingComputer compares the lure to earlier North Korean fake-recruitment campaigns known as Contagious Interview and Operation Dream Job, and notes that Binance has not linked the compromise to either. That comparison is BleepingComputer's.
Who: Software Engineer B
Approach: a legitimate job-hunting platform, a fake Project Director
Interviews: a live video call with a fake HR representative, then a fake CEO
Not named: the platform or the company
Engineer B was instructed to download an "assignment" containing a malicious code repository onto his work computer. Binance says the code replaced a legitimate development tool component with a malicious version, used obfuscation to evade detection, and established communication with an attacker-controlled external server. Binance calls it 0-day malware and says the endpoint security tools did not detect it at the time; the 0-day label is Binance's.
The file operations Binance published show which tool: pyenv, the Python version manager, installed through Homebrew. A new file was created beside the real pyenv, the valid pyenv was deleted, the new file was renamed into its place, and the link in Homebrew's bin directory was deleted and a new symlink created before a zsh shell was spawned. A developer runs a tool like pyenv routinely, so a replaced copy runs again each time it is used, which is why this step maps to Compromise Host Software Binary.
Swapped: the valid pyenv (3,344 B) deleted, pyenv_ (3,414 B) renamed to pyenv
Relinked: /opt/homebrew/bin/pyenv deleted and a new symlink created, then zsh spawned
Detection: none by endpoint tools at the time, per Binance
From Engineer B's compromised computer, Binance says, the attacker used an internal AI tool to gain control over Wallet DevOps Engineer A (the same label Binance gives the engineer from June) and Wallet Software Engineer C. Binance does not say what the tool is for, what permissions it held, or how it gave the attacker control. CSO Online reports that Binance did not clarify the tool's purpose to CSO either. With no public mechanism, this page does not map that movement to an ATT&CK technique.
The attacker then discovered that Engineer A had a container deployment permission token on his computer. Binance does not say how the token was stored or how long it stayed valid, and CSO Online lists the token's lifetime among the questions Binance did not answer.
From: Engineer B's compromised computer
Through: an internal AI tool; purpose and permissions not disclosed
Reached: Wallet DevOps Engineer A and Wallet Software Engineer C
Found: a container deployment permission token on Engineer A's computer
Binance places this between 17:15 and 19:56 on October 29. It gives no timezone for that window, although the other times in its post are UTC. Binance does not say where the container ran, which platform deployed it, whether the deployment needed approval, or how code in the container authenticated to the wallet signing service. CSO Online describes the token as allowing new containers to be deployed on the company's infrastructure, and lists deployment approval and authentication between the container and the signing service among the questions Binance did not answer.
The account changed between updates. Binance's first update, on October 30, said its initial investigation suggested the incident may involve a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawal transactions. Its second update that day said later investigation had found additional points of breach, and the November 3 post traces the campaign back to the June installer and the September fake interview. Binance co-CEO Richard Teng also said, as quoted by The Record, that the attacker used a self-destruct mechanism that destroyed tooling and traces as it went.
From: Software Engineer C's computer
Credentials: stolen from Wallet DevOps Engineer A
Action: deployed a container and triggered a malicious script
Not disclosed: where the container ran, how it reached the signing service
Binance says the attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process. Its October 30 updates said it had found no evidence that wallet private keys were leaked. The on-chain analysts read the transactions the same way: Elliptic says the on-chain evidence suggests the attacker got Binance's own systems to sign transactions on its behalf, and TRM assessed that the evidence points to a compromise of Binance's hot wallet signing infrastructure. Trail of Bits draws the general point that a compromised server with permission to request signatures "can misuse a protected key without extracting it."
Binance lists the outflows: five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, Solana and Optimism hot wallets sent about 970,500 SOL and 44.2 million OP, and one hot wallet sent 18,270 BTC. Elliptic reports that a hot wallet known as Binance 16 sent 28,006 ETH and other tokens worth $174 million directly to the attacker, signed with its own key. TRM puts most of the theft in about 20 minutes starting at 20:05 UTC. Chainalysis puts the start at about 4:20 p.m. ET, which is 20:20 UTC, fifteen minutes later than Binance, TRM and Elliptic.
XRP: 233.46 million from five hot wallets, 20:05 to 20:09 UTC
SOL and OP: about 970,500 SOL and 44.2 million OP
BTC: 18,270 from one hot wallet
Private keys: no evidence of a leak, per Binance
EIP-7702 lets an Ethereum account authorize a contract to act with that account's authority. Binance says the attacker submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. TRM and Elliptic, reading the chain, describe a single transaction carrying 50 authorizations, each for a different nonce so that one would match the wallet's transaction count. Elliptic times that transaction at 20:20 UTC, and says the sweeper contract had been deployed at 15:59 UTC and rehearsed on another wallet about four hours before it was used against Binance. Elliptic says all 50 were validly signed with the key of the hot wallet known as Binance 14. About three and a half minutes later the attacker's sweeper contract emptied that wallet of 167,464 ETH and 63 tokens, including 1.6 billion USDT. The attacker also used Binance 14's owner rights over another Binance wallet to pull 823 million USDC from it. Teng, as quoted by Elliptic, said the delegation "did not pass through our normal approval controls."
Revoking it took a special procedure. Because the hot wallet used Multi-Party Computation (MPC), Binance says, no single private key could immediately revoke the authorizations, and its team needed a specialized revocation procedure. TRM reports that the delegation stayed in place and swept newly arrived funds at six later times; Elliptic counts four later sweeps. Both put the last at 23:56 UTC. Binance says the final unauthorized transfer, 2,961.9 ETH, finalized then, and the delegation was cleared at 00:10 UTC on October 30. ATT&CK has no technique for delegating a smart account; Account Manipulation is the closest fit for standing authority added to an existing account.
Signed with: the key of hot wallet Binance 14 (Elliptic)
First sweep: 167,464 ETH and 63 tokens, including 1.6 billion USDT (Elliptic)
Also pulled: 823 million USDC from another Binance wallet, through Binance 14's owner rights (Elliptic)
Last transfer: 2,961.9 ETH at 23:56 UTC; delegation cleared at 00:10 UTC (Binance)