The world's largest crypto exchange, Binance, has published the first part of a technical report detailing a sophisticated, multi-month campaign attributed by the company to a North Korea-linked hacking group. The document reveals for the first time the sequence of stages in preparing and executing the attack: from initial supply chain penetration in June 2026 to unauthorized transactions initiated on October 29. According to the report, the attackers did not rely on a single breach, but instead built access in layers, progressively expanding their presence within the company's infrastructure.
Entry Point: Supply Chain in June
According to the published portion of the report, the campaign began back in June 2026 with a supply chain attack. One of the company's engineers downloaded a compiled version of a popular tool via a compromised repository. This exact step, Binance describes, laid the groundwork for the attackers' continued presence in the development environment: the malicious component entered the workflow before being detected, allowing the actors to establish a foothold in the infrastructure.
Social Engineering: Fake Interviews in September
In September 2026, according to the report, the attackers moved to an advanced social engineering phase. Posing as fake interviews—involving a phony HR specialist and an individual impersonating the "CEO"—the actors convinced another employee to download a test assignment containing a malicious repository. Thus, the group gained an additional access channel independent of the initial supply chain entry point.
Zero-Day and Internal AI Tool as a Bridgehead
Using zero-day malware that bypassed endpoint protection tools, the attackers gained control over the engineer's workstation, as Binance describes. In October, the actors utilized the company's internal AI tool as a bridgehead for further penetration, including targeting the crypto wallet signature infrastructure. This stage, according to the report, became critical: access to the tool, which holds a privileged position within the network, allowed the attackers to approach the components responsible for authorizing operations.
October 29: Protocol Bypass and Unauthorized Transactions
The culmination of the campaign, according to the published part of the report, occurred on October 29, 2026. The actors bypassed security protocols and initiated unauthorized transactions using smart contract vulnerabilities and EIP-7702 delegation mechanisms. It was this combination of contract-level vulnerabilities and delegated authorities, the company describes, that made operations possible which would normally have been blocked.
Context and Significance of the Report
The publication of Binance's technical report fits into the broader context of the platform's operations: in September 2026, the company announced the termination of direct operations with the Ukrainian hryvnia starting September 28, and negotiated the creation of a hub in Kazakhstan for CIS settlements. Against this background, disclosing details of the attack, which Binance links to a North Korean group, underscores that threats to crypto infrastructure are not only market-driven but also cybernetic. The first part of the report outlines the chronology and methods; the company leaves final conclusions and full details for subsequent publications.
