---
title: Binance's initial report on the $6.34B Oct 29 theft: a fake job interview, a tampered pyenv, an internal AI tool used to reach wallet engineers, then EIP-7702 delegations that kept draining after withdrawals stopped | ctxsec
url: https://ctxsec.com/items/binance-oct-29-initial-findings-fake-interview-homebrew-internal-ai-tool-eip-7702
description: "Binance published its first findings on the Oct 29 hot-wallet theft, which the FBI attributes to North Korea. In September an engineer was approached on a job platform, put through two staged interviews and told to download a take-home 'assignment' onto his work computer; setup code swapped Homebrew's pyenv for a malicious version that endpoint tools didn't detect. On Oct 20 the attacker used that machine and an internal AI tool to gain control over two wallet engineers, one of whom held a container deployment token. On Oct 29 the attacker deployed a container, reached the internal wallet signing service and signed transfers outside the normal withdrawal flow."
status: "official (Binance initial incident report, published on X Nov 3). Binance says the investigation is ongoing and some technical details are withheld"
published: 2026-11-03
---

> Binance published its first findings on the Oct 29 hot-wallet theft, which the FBI attributes to North Korea. In September an engineer was approached on a job platform, put through two staged interviews and told to download a take-home 'assignment' onto his work computer; setup code swapped Homebrew's pyenv for a malicious version that endpoint tools didn't detect. On Oct 20 the attacker used that machine and an internal AI tool to gain control over two wallet engineers, one of whom held a container deployment token. On Oct 29 the attacker deployed a container, reached the internal wallet signing service and signed transfers outside the normal withdrawal flow.

[← Cybersecurity News](/news) · [markdown](/items/binance-oct-29-initial-findings-fake-interview-homebrew-internal-ai-tool-eip-7702.md)

official (Binance initial incident report, published on X Nov 3). Binance says the investigation is ongoing and some technical details are withheld

2026-11-03

### Binance's initial report on the $6.34B Oct 29 theft: a fake job interview, a tampered pyenv, an internal AI tool used to reach wallet engineers, then EIP-7702 delegations that kept draining after withdrawals stopped

- **Earlier exposure:** in June a Wallet DevOps engineer installed a tampered Homebrew package while searching for a popular AI coding tool. Binance replaced the device and rotated credentials, but says the team's roles were exposed to the attacker. Binance blocked 57 suspected North Korea-linked attempts in 2026.
- **Theft (UTC, Oct 29):** 233.46M XRP from five hot wallets between 20:05 and 20:09, then about 970,500 SOL, 44.2M OP and 18,270 BTC. The final transfer, 2,961.9 ETH, settled at 23:56.
- **Why containment was slow:** the attacker used the signing service to sign about 50 transactions setting up EIP-7702 delegations to an attacker contract. Those kept working on-chain after Binance halted withdrawals, and because the wallet used multi-party computation (MPC) there was no single key to revoke them quickly. The delegation was cleared at 00:10 UTC on Oct 30.
- **Impact:** about $6.34B affected, about $2.85B frozen or intercepted; Binance says it is covering losses and had replenished 98% of affected token assets by Oct 31.

**Lessons for everyone, not just exchanges:** (1) Take-home coding tests are a delivery channel; they belong in a disposable VM, never on a work laptop. (2) Internal AI tools that can act across colleagues' machines or accounts are lateral-movement infrastructure; scope and log them like admin tools. (3) Deployment tokens on developer laptops are crown jewels. (4) If you run EVM hot wallets, your playbook needs a tested way to revoke EIP-7702 delegations, because pausing withdrawals won't do it.

Sources: [Binance on X: 29 October Binance Security Incident: Initial Findings and Response Update (Nov 3)](https://x.com/binance/status/2117626126214504729) · [FBI: North Korea responsible for $6 billion Binance attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) · [The Record: Binance CEO says 'months-long campaign' led to $6.3 billion theft](https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea)