A fake “recruiter” led to several interview rounds. In September, a test file replaced legitimate pyenv with a backdoored copy. Security tools missed the malware, described as a zero-day.

By 20 October, attackers controlled wallets through Binance’s internal AI tool. On 29 October, they reached a third employee’s computer. Hot-wallet transfers using MPC continued for almost 2 hours because no single private key could revoke the malicious EIP-7702 permissions.

Binance says about $2.85 billion was frozen or intercepted. 98% of affected tokens has been reimbursed, users will not bear losses, and the FBI attributes the attack to North Korean group TraderTraitor.