---
title: "Binance’s $6.34 Billion Hack Ran on a Pectra Feature and a Fake Job Offer"
description: "North Korea’s TraderTraitor spent four months getting one engineer’s laptop, then drained wallets on ten chains in 20 minutes"
author: "Luis Goa"
published: 2026-11-04T16:06:03Z
modified: 2026-11-05T01:48:42Z
url: https://rews.cc/a/binance-s-6-34-billion-hack-ran-on-a-pectra-feature-and-a-fa-eb4fc3
language: en
tags: ["crypto", "cybersecurity", "binance", "malware", "social-engineering", "tech"]
publisher: "Rews (https://rews.cc)"
---

# Binance’s $6.34 Billion Hack Ran on a Pectra Feature and a Fake Job Offer

*North Korea’s TraderTraitor spent four months getting one engineer’s laptop, then drained wallets on ten chains in 20 minutes*

By Luis Goa · November 4, 2026 · https://rews.cc/a/binance-s-6-34-billion-hack-ran-on-a-pectra-feature-and-a-fa-eb4fc3

## In brief

- Binance says $6.34 billion in assets were affected by an Oct. 29 hot-wallet theft, the largest crypto heist on record
- Attackers spent four months getting in: a tampered Homebrew install in June, a fake job interview in September, lateral movement via an internal AI tool on Oct. 20
- The final theft exploited Ethereum’s EIP-7702 feature to delegate a Binance hot wallet’s execution rights to an attacker-controlled contract
- Binance’s multi-party-computation wallet design meant no single key could revoke the malicious delegation, delaying containment nearly four hours
- The FBI, TRM Labs and Chainalysis attribute the attack to North Korea’s TraderTraitor unit; Pyongyang denies involvement

$6.34 billion is the figure Binance puts on the assets it says were affected by an Oct. 29 theft from its hot wallets, according to [the company’s own incident report, as covered by Ars Technica](https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/). TRM Labs, the blockchain-intelligence firm tracking the stolen funds on-chain, [puts the gross outflow slightly higher](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history): $6.36 billion moved out of Binance wallets across ten blockchains, most of it inside a 20-minute window starting at 20:05 UTC on Oct. 29. The numbers differ because the counting methods do. Binance says it has frozen or intercepted $2.85 billion with help from Tether, Circle and Ripple; either way, more than half the loot is outside anyone’s reach, and the whole sum is about four times the $1.5 billion taken from Bybit in February 2025, until now the largest crypto theft on record.

Binance’s co-CEO Richard Teng told [CNBC](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html) the exchange has already replenished 98% of the affected assets from its own balance sheet and that customers will not bear the loss. That figure is Binance’s own accounting; no outside auditor has yet confirmed it, though the company says independent reviewers are being brought in.

## Four months, three compromises

The theft was not a single break-in. According to Binance’s report and [CoinDesk’s account of it](https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says), it started in June, when a wallet-infrastructure engineer searching for an AI coding tool installed a tampered version of Homebrew; Binance’s security team swapped the laptop, but not before the malware had mapped which engineers worked on wallet infrastructure. In September, a different engineer on that team was approached by someone posing as a hiring manager, interviewed by a fake HR contact and a fake CEO, and ended by downloading a coding-test repository carrying zero-day malware past the endpoint-security tools then in use. On Oct. 20, the attackers used that laptop together with an internal Binance AI tool to reach two more wallet-team devices. On Oct. 29, using credentials lifted from one of those machines, they ran a script that reached into Binance’s internal wallet-signing service, the system that turns an approved withdrawal into a signed transaction.

**How the breach moved** Binance's account of the intrusion chain, June to October 2026

| From | To | How |
| --- | --- | --- |
| Tampered Homebrew install *(June)* | Wallet-team roles mapped |  |
| Wallet-team roles mapped | Fake job interview *(September)* |  |
| Fake job interview *(September)* | Zero-day malware on laptop |  |
| Zero-day malware on laptop | Lateral move via internal AI tool *(Oct. 20)* |  |
| Lateral move via internal AI tool *(Oct. 20)* | Signing-service credentials stolen *(Oct. 29)* |  |
| Signing-service credentials stolen *(Oct. 29)* | EIP-7702 delegation to attacker contract |  |
| EIP-7702 delegation to attacker contract | Hot wallets drained, 10 chains |  |
| Hot wallets drained, 10 chains | Laundering via swaps, bridges, DeFi |  |

![How the breach moved. Binance's account of the intrusion chain, June to October 2026](https://rews.cc/img/8351a95fa26e44e3648d26af48adff7361a2315b.webp)

Based on [Binance incident report, as described by Ars Technica and CoinDesk](https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/)

Each box above is a compromise that, on its own, Binance’s defenses caught or would plausibly have caught: a swapped laptop here, a flagged malware sample there. Chained together over four months, they got the attackers from a search-engine result to control of a signing service for an exchange processing billions of dollars a day.

[![A Fake Job Interview Led to the $6B Binance Hack](https://i.ytimg.com/vi/IGUI7Cqb6Gk/hqdefault.jpg)](https://www.youtube.com/watch?v=IGUI7Cqb6Gk)

A YouTube explainer on how a fake recruitment process led to the malware that compromised the Binance engineer’s laptop. Video: Nicholas Thompson · YouTube

## The EIP-7702 trick

Binance’s security chief, Jimmy Su, told reporters the attackers used Ethereum’s EIP-7702 feature, introduced in the Pectra upgrade in May 2025, to obtain execution rights over a hot wallet. EIP-7702 lets an ordinary wallet sign an authorization handing control of its behavior to a smart contract; it exists to let regular wallets act like programmable smart accounts. According to TRM’s reconstruction, the attackers pre-signed 50 such authorizations against Binance 14, a wallet with more than 31 million transactions in its history, each keyed to a different account nonce, the counter that must match exactly for a transaction to execute. Because the wallet processes a continuous stream of withdrawals, one nonce was bound to be live. It was: at 20:20:59 UTC the delegation went through to a sweeper contract only the attacker could call. Three minutes and twenty-four seconds later, 167,464 ETH and 63 tokens left the wallet, and the delegation let the attackers keep re-sweeping new deposits into it for hours.

## A key nobody could turn

Binance’s hot wallets use multi-party computation, splitting signing authority across several parties so no single device ever holds a complete private key, specifically to prevent one compromised machine from draining a wallet. That design also meant there was no single key Binance could rotate to kill the malicious delegation once found; the authorization lived on-chain, independent of Binance’s withdrawal infrastructure, and shutting off withdrawals did nothing to it. Building a custom set of revocation transactions took from the first fund movements around 20:05 UTC to full containment at 00:10 the next day, nearly four hours during which the Bitcoin, Tron, XRP Ledger, Solana and other wallets kept being swept using ordinary, validly signed transfers that involved no EIP-7702 delegation at all. TRM’s assessment is blunt: the attacker had gained the ability to make Binance’s signing system sign whatever it wanted, across chains, not just exploit one Ethereum feature.

Ethereum alone accounts for $3.79 billion of the total, 60% of it, because the delegation let the attackers keep draining the same wallet repeatedly. The 18,270 BTC taken, worth $1.47 billion, moved out in a single conventional transfer with no equivalent trick available on Bitcoin.

## Chasing the money

The bitcoin went into a peel chain, splitting into 1,000 BTC and 100 BTC pieces within the same block, a standard way to break a large sum into pieces too numerous to track by hand. On Ethereum, the attackers sold roughly 325 million USDT through UniswapX and intent-based market makers for about 122,300 ETH, accepting a discount of more than 10% off spot, near $2,650 per ETH, in exchange for speed. A second wallet deposited 60 million USDT into the lending protocol Aave and borrowed roughly 19,760 ETH against it before Aave froze the affected markets.

![Yellow circles fall into a dark blue colander and emerge through its holes as streams of smaller yellow dots against a teal background.](https://rews.cc/img/0ea9671190de5c78da5d2db98df3b7432bb7b40e.webp)

On Tron, [TRM documented](https://www.trmlabs.com/resources/blog/binance-hack-update-north-korea-launders-proceeds-through-self-minted-tokens-and-chained-bridges) a scheme designed to break the trace that a public ledger otherwise makes trivial. An address tied to the hack minted its own token on Oct. 31 and paired it in a liquidity pool with a lending protocol’s receipt token. Buyer wallets fed stolen funds into the pool; the attacker’s wallet minted tokens for free and sent them to a separate seller wallet, which sold into the pool and cashed out. Followed only through the receipt token or only through USDT, no transfer connects buyer to seller. On Nov. 1 alone, one such seller wallet withdrew nearly $100 million this way, split across five new wallets that placed 38 orders worth 966,558 USDT on a swap router in the space of an hour.

The clawback with the most interesting precedent happened on Arbitrum, where the network’s Security Council, a multi-signature group with emergency powers over the chain, force-transferred 8,426 ETH and 74.6 million ARB out of an attacker-controlled address at 00:08 UTC, without the attacker’s cooperation. That is a chain operator reaching in and reversing a transaction after the fact, the kind of intervention permissionless blockchains are nominally designed to make impossible, done here because the Council judged a $6 billion theft an emergency worth the precedent.

## Attribution, denial, and the bigger number

The FBI, together with the Secret Service and IRS Criminal Investigation, attributed the attack to TraderTraitor, the North Korean unit it also named for the Bybit hack, and [published a list of addresses it is asking exchanges, bridges and DeFi services to block](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758). TRM and [Chainalysis](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/) reached the same conclusion independently; Chainalysis says it found the stolen funds commingling on-chain with the proceeds of September’s [$387 million Bitget theft](https://rews.cc/a/chainalysis-says-north-korea-took-bitget-for-387m-and-its-ai-fd3fb2), which it had already attributed to the same actors. North Korea denied involvement; Kim Yo-jong, sister of Kim Jong Un, called the FBI’s naming of TraderTraitor “a grave political provocation” in remarks [reported by SBS](https://news.sbs.co.kr/english/article.do?news_id=N1008829227).

> The U.S. misleading international public opinion as if all cyber fraud occurring around the world is our doing is clearly a grave political provocation against us.

A United Nations Security Council Panel of Experts has previously estimated that cyber theft supplies about half of North Korea’s foreign-currency earnings, [according to reporting on the panel’s findings](https://news.bitcoin.com/un-report-crypto-crime-provided-north-korea-up-to-half-of-its-foreign-currency-income/); an earlier assessment put the share funding its nuclear and missile programs specifically at up to 40%. Measured in single incidents, the trend has gone from $1.5 billion at Bybit in February 2025 to $387 million at Bitget in September 2026 to $6.34 billion at Binance five weeks later, more than sixteen times the previous record in a year and a half. Binance says it blocked 57 other suspected North Korea-linked intrusion attempts in 2026 alone. Whether that reflects better detection or a larger volume of attempts is not something Binance’s report says, and it is the next figure worth getting.

## See also

- [FBI alert: North Korea Responsible for $6 Billion+ Binance Attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) — fbi.gov · Official attribution and list of addresses linked to the theft
- [NPR: A simple explainer of the $6.3 billion crypto heist at Binance](https://www.npr.org/2026/10/31/nx-s1-6024426/binance-crypto-heist-cyber-criminals-north-korea) — npr.org · Plain-language overview for non-technical readers