FBI links Binance wallet theft to North Korean actors

Binance reports that on 29 October 2026, attackers drained multiple hot wallets within four minutes, transferring 233.46 million XRP to an attacker address, followed by assets on Solana, Optimism and Bitcoin wallets. The exchange says the intruders abused an internal signing service and Ethereum’s EIP-7702 feature, allowing an attacker contract to gain partial control of a hot wallet.

Binance notes that these on‑chain permissions operated independently of the exchange’s normal withdrawal infrastructure, meaning that suspending withdrawals would not stop every transfer. The final unauthorized transfer settled at 23:56 UTC.

The company attributes the activity to actors linked to the Democratic People’s Republic of Korea, citing FBI information and noting that 57 North Korea‑linked threats were blocked in 2026. Binance states that about USD 2.85 billion was frozen or intercepted, and that 98% of the affected token assets were replenished by 31 October, though figures remain subject to reconciliation.

The hack is described as the culmination of months of preparation, including a tampered Homebrew installer used by a wallet engineer in June and a staged fake interview in September that delivered malicious code via an assignment, enabling the attacker to abuse an internal AI tool to reach additional engineers and obtain a container deployment token for the October incident.

Binance says it has rebuilt the wallet system and AI tooling, replaced devices, revoked credentials, and engaged external security firms for an independent review.