--- title: "Binance Unveils Scheme of 'Comrade Kim's Hackers' Multi-Month Attack: From Compromised Repository to Wallet Signature Bypass" description: "Binance has published the first part of a technical report on a multi-month cyberattack by a North Korea-linked group, ranging from a compromised repository in June to unauthorized transactions on October 29." date: 2026-11-04T01:13:20.815Z lang: en url: https://xab.info/en/posts/binance-report-north-korea-attack tags: [binance, north-korea, cyberattack, cryptocurrency, eip-7702, supply-chain-attack, social-engineering] author: "Alexander Buran" publisher: "XAB.info" --- # Binance Unveils Scheme of 'Comrade Kim's Hackers' Multi-Month Attack: From Compromised Repository to Wallet Signature Bypass ![North Korean hackers at computers against the backdrop of Kim's portrait and cryptocurrency charts](https://xab.info/media/2026/11/04/binance-otchet-o-atake-severnoi-korei/binance-otchet-o-atake-severnoi-korei-1.webp) ## Key Points - Binance published the first part of a technical report on a multi-month attack by a North Korea-linked group. - The campaign began in June 2026 with a supply chain attack via a compromised repository. - In September, the attackers employed social engineering through fake job interviews. - In October, zero-day malware and an internal AI tool provided access to wallet signature infrastructure. - On October 29, unauthorized transactions were initiated using smart contract vulnerabilities and EIP-7702. The world's largest crypto exchange, Binance, has published the first part of a technical report detailing a sophisticated, multi-month campaign attributed by the company to a North Korea-linked hacking group. The document reveals for the first time the sequence of stages in preparing and executing the attack: from initial supply chain penetration in June 2026 to unauthorized transactions initiated on October 29. According to the report, the attackers did not rely on a single breach, but instead built access in layers, progressively expanding their presence within the company's infrastructure. ### Entry Point: Supply Chain in June According to the published portion of the report, the campaign began back in June 2026 with a supply chain attack. One of the company's engineers downloaded a compiled version of a popular tool via a compromised repository. This exact step, Binance describes, laid the groundwork for the attackers' continued presence in the development environment: the malicious component entered the workflow before being detected, allowing the actors to establish a foothold in the infrastructure. ### Social Engineering: Fake Interviews in September In September 2026, according to the report, the attackers moved to an advanced social engineering phase. Posing as fake interviews—involving a phony HR specialist and an individual impersonating the "CEO"—the actors convinced another employee to download a test assignment containing a malicious repository. Thus, the group gained an additional access channel independent of the initial supply chain entry point. ### Zero-Day and Internal AI Tool as a Bridgehead Using zero-day malware that bypassed endpoint protection tools, the attackers gained control over the engineer's workstation, as Binance describes. In October, the actors utilized the company's internal AI tool as a bridgehead for further penetration, including targeting the crypto wallet signature infrastructure. This stage, according to the report, became critical: access to the tool, which holds a privileged position within the network, allowed the attackers to approach the components responsible for authorizing operations. ### October 29: Protocol Bypass and Unauthorized Transactions The culmination of the campaign, according to the published part of the report, occurred on October 29, 2026. The actors bypassed security protocols and initiated unauthorized transactions using smart contract vulnerabilities and EIP-7702 delegation mechanisms. It was this combination of contract-level vulnerabilities and delegated authorities, the company describes, that made operations possible which would normally have been blocked. ### Context and Significance of the Report The publication of Binance's technical report fits into the broader context of the platform's operations: in September 2026, the company announced the termination of direct operations with the Ukrainian hryvnia starting September 28, and negotiated the creation of a hub in Kazakhstan for CIS settlements. Against this background, disclosing details of the attack, which Binance links to a North Korean group, underscores that threats to crypto infrastructure are not only market-driven but also cybernetic. The first part of the report outlines the chronology and methods; the company leaves final conclusions and full details for subsequent publications. ## Fact-Check & Sources - [Криптобиржа Binance подтвердила, что за недавней атакой стояли умельцы товарища Кима](https://www.goha.ru/kriptobirzha-binance-podtverdila-chto-za-nedavnej-atakoj-stoyali-umelcy-tovarishha-kima-xRr2yB) - Primary source: the first part of Binance's technical report. Chronology (June — supply chain; September — social engineering; October — workstation control and AI tool; October 29 — unauthorized transactions via EIP-7702 and smart contract vulnerabilities). Attribution to North Korea is Binance's assessment. - [Binance договорилась о создании в Казахстане хаба для расчетов по СНГ](https://www.kommersant.ru/doc/8938251) - Used solely as background context for Binance's operations; not related to the cyberattack. - [Крупнейшая в мире криптобиржа прекратит работу с гривной](https://www.gazeta.ru/business/news/2026/09/23/29380705.shtml) - Termination of direct operations with the hryvnia from September 28, 2026, is background context, unrelated to the attack. ## FAQ ### When did the attack begin according to the Binance report? According to the published portion of the report, the campaign began in June 2026 with a supply chain attack when an engineer downloaded a compiled version of a tool via a compromised repository. ### How did the attackers gain additional access in September? Through social engineering: posing as fake interviews with a phony HR and 'CEO', they persuaded an employee to download a test assignment with a malicious repository. ### What happened on October 29, 2026? According to the report, the attackers bypassed security protocols and initiated unauthorized transactions using smart contract vulnerabilities and EIP-7702 delegation mechanisms. ### Who does Binance assess is behind the attack? Binance links the attack to a hacking group associated with North Korea. This is the company's assessment based on its technical report.