TraderTraitor / fake job interview campaign: Binance — $6.43B crypto heist via tampered Homebrew, fake interviews and abused internal AI tool
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
Binance's Nov 3, 2026 post-mortem details the record $6.43B theft (Oct 29) as a months-long North Korean TraderTraitor campaign. In June, Wallet DevOps 'Engineer A' downloaded a trojanized Homebrew installer via a search-engine result to install an AI tool; Binance detected it and rotated credentials, but team information leaked. In September, 'Engineer B' was lured through a fake two-round job interview (HR persona, then fake CEO) into downloading a malicious code 'assignment' whose zero-day malware replaced the pyenv executable, evaded endpoint tools and removed forensic artifacts. On Oct 20 attackers used Engineer B's machine and the internal AI tool to compromise Engineers A and C; on Oct 29 (17:15–19:56) they used stolen container-deployment credentials to deploy a container, access the wallet-signing service, move XRP, SOL, OP and BTC (~$400M then $1.4B in BTC, 50 more transactions) and abuse EIP-7702 to delegate execution over the Binance14 hot wallet. ~$2.85B frozen; withdrawals resumed Nov 1; systems rebuilt, credentials decommissioned, independent review underway. Chainalysis links $14.3M in prior fake-interview thefts; DPRK denies involvement.
What to do
- Audit and rotate engineer credentials, tokens and container-deployment permissions, especially for wallet/signing infrastructure
- Scan endpoints for tampered Homebrew/pyenv components and zsh-launched malware; verify integrity of developer toolchains
- Restrict and monitor internal AI tooling and wallet-signing services; require step-up authentication for delegation and signing operations
- Harden EIP-7702 delegation handling on hot wallets and monitor on-chain authorizations independently of withdrawal infrastructure
- Train staff on fake-recruiter social engineering; scrutinize code 'assignments' from external hiring contacts
Sources
All live incidents on Threat Watch
