Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist

Hi, what are you looking for?

Binance’s first incident report traces the record theft to a months-long campaign that compromised three engineers’ computers.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Binance says the hackers behind last week’s$6.34 billion theftreached its wallet signing systems after a months-long campaign that compromised three engineers’ computers, one of them through a fake job interview.The exchange published its initialincident reporton November 3. Roughly $2.85 billion of the stolen assets has been frozen or intercepted.“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.The FBI has blamed the theft onTraderTraitor, a North Korean state-sponsored hacking group.How the attack unfoldedAccording to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The exchange published its initialincident reporton November 3. Roughly $2.85 billion of the stolen assets has been frozen or intercepted.“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.The FBI has blamed the theft onTraderTraitor, a North Korean state-sponsored hacking group.How the attack unfoldedAccording to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.The FBI has blamed the theft onTraderTraitor, a North Korean state-sponsored hacking group.How the attack unfoldedAccording to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The FBI has blamed the theft onTraderTraitor, a North Korean state-sponsored hacking group.How the attack unfoldedAccording to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

According to Binance, the intrusion unfolded in stages and relied on fake recruiters, malicious downloads, hijacked employee computers and an internal AI tool. “It was not a single isolated breach or a simple phishing incident,” the company noted.The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The campaign started in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine.Advertisement. Scroll to continue reading.Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Binance’s security team caught it, swapped out his device and reset the related credentials. Even so, the attackers had already gained insight into what he did and who he worked with on the wallet infrastructure team.In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

In September, a second engineer was approached by someone claiming to be a project director. He was invited to two interviews, the first with a fake HR representative and the second with the alleged CEO of a company that did not exist.During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

During the first interview, the HR impostor shared a social media account containing personal photos and videos to build rapport. The second took place over a chat app and ended with a request to download a coding “assignment” onto his work computer.The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The assignment hid a malicious code repository that executed as soon as the engineer set it up. The malware substituted a rogue copy of a legitimate developer tool component and opened a channel to a server run by the attackers.“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

“The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance said.On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

On October 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer’s system and a third wallet engineer’s system. The report does not explain how the AI tool was used.The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The first engineer’s computer held a token that allowed container deployments. On October 29, the attackers signed into the third engineer’s computer, deployed a container with credentials taken from the first engineer and kicked off the attack with a malicious script.Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Binance says the attackers exploited unauthorized access to an internal wallet signing service to move XRP, SOL, OP and BTC out of its hot wallets. The same service was used to abuse Ethereum’s EIP-7702 mechanism, giving a contract under the attackers’ control partial execution rights over a hot wallet.“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

“However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the company explained.The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The hot wallet was secured with multi-party computation (MPC), which meant Binance had no single key it could use to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC, and the delegation was cleared shortly after midnight.Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and retired the engineers’ credentials and tokens. It is engaging independent security firms to review the incident and is working on a research fund focused on AI security in blockchain environments.The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The exchange also disclosed that it had detected and blocked 57 suspected North Korea-linked threats this year.Other developmentsNorth Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

North Korea has rejected theFBI’s attributionof the heist to its TraderTraitor hackers. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state media.[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

[ Read:North Korea Launches Missiles Toward the Sea to Protest Binance Hack Claims]Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Binance has also completed a zero-knowledge proof for its October 31 reserves snapshot, which lets holders of 10 major tokens verify that their balances are backed at least 1:1. Co-CEO Richard Teng says 98% of the impacted tokens have now beenreplenished.Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Teng also said on November 3 that withdrawals have broadly resumed. The exchange began reopening them in phases on November 1.On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

On the laundering front,Ellipticsays the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, using automation but with no sign of AI agents making decisions. As of November 3, roughly $3.18 billion remained in theft-linked addresses. Separately, Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, had temporarilyslowed the laundering.Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Rob T. Lee has joined Dragos as Chief AI Officer.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.