A fake interview created the route into the system
According to Binance, an employee was approached through a legitimate job platform and asked to download a coding assignment during a second fake interview. The repository contained malware that replaced a development component and opened remote access.
The attackers later obtained a container deployment token and used it to reach wallet-signing operations. The sequence shows how one compromised device can become a bridge to a privileged service when internal access is not sufficiently separated.
EIP-7702 permissions required separate action
Ethereum transfers used EIP-7702 through 50 authorisations. Those blockchain permissions could remain active independently of the ordinary withdrawal system, so suspending customer withdrawals alone did not stop every pending transaction.
Binance says the permissions were revoked on 30 October at 00:10 UTC. Withdrawals began returning in stages on 1 November while the exchange rebuilt affected systems, replaced devices and retired related credentials.
Investigators linked the attack to TraderTraitor
On 31 October the FBI officially attributed the attack to the North Korean group known as TraderTraitor. Binance said it would cover the loss from its own funds and reported that roughly 95 per cent of the affected collateral had been restored by 2 November, with the ten main tokens fully backed.
The figures need precise labels. Binance estimates that $2.85 billion was frozen or intercepted. Independent blockchain firm Bitquery put the frozen amount near $2.7 billion, while around $3 billion was still controlled by the attackers on 3 November.
The incident exposes an access-control problem
The weakness described in the report is not a broken blockchain. It is the path from an employee device to a deployment process and then to a signing service. Stronger separation of duties and alerts for unusual container activity are therefore as important as protecting wallet keys.
Users should rely on official status pages and ignore messages that use the breach as a reason to request credentials or wallet transfers. A technical explanation of the attack does not make unsolicited recovery offers safe.
This article is for information only and is not investment advice.
admin_wcContributor · World-CryptMore from
