2026-10-29 · By JUST G
Binance Hot Wallets Drained for Billions. Did Lazarus Get In Through a Fake Job Interview?
Billions left Binance hot wallets on Thursday, 2 days after Binance said it blocked a North Korea-linked fake job interview campaign. Here's what's confirmed, who froze what, and my theory on why the two might be connected.
Billions left Binance hot wallets on Thursday, 2 days after Binance said it blocked a North Korea-linked fake job interview campaign. Here's what's confirmed, who froze what, and my theory on why the two might be connected.
I spent Thursday on a cross-state day trip, driving pretty much all day. My Coinbase notifications kept buzzing: Solana down 3%, then down 5%. Annoying. Every time I glanced at my phone along the way, I thought, wtf?
Then I got home and saw what happened. At 4:24 PM ET, 1 of Binance's busiest Ethereum hot wallets had been emptied in a single transaction.
Once I dug in, my first thought was the post Binance put out on Tuesday saying it had blocked a North Korea-linked fake job interview campaign. I have a theory about that. First, what's confirmed.
All numbers are as of about 8:15 PM ET Thursday, Oct 29. This is still moving.
Timeline at a glance
All times ET.
- Tue Oct 27: Binance says it blocked multiple North Korea-linked attacks tied to "Contagious Interview" (Odaily)
- Wed Oct 28, about 2 to 3 AM: Binance's scheduled Ethereum wallet maintenance (PANews)
- Wed Oct 28, 3:39 AM: Attacker's relayer gets its first Tornado Cash funding (Etherscan)
- Thu Oct 29, 11:59 AM: Sweeper contract deployed (Etherscan)
- 4:20 PM: EIP-7702 delegation set on Binance 14 (Etherscan)
- 4:24 PM: Binance 14 swept (Etherscan)
- 5:01 PM and 5:05 PM: Tether (Etherscan), then Circle (Etherscan), blacklist the receiving address
- 5:04 PM: Binance 14 swept a second time (Etherscan)
- 5:15 PM: CZ: "it does look like a hack on Binance" (X)
- 7:22 PM: Binance: $2.54 billion verified frozen (X)
- 7:56 PM: Attacker sweeps 2,961.91 ETH that a Binance deposit address had just sent into Binance 14 (Etherscan)
- 8:13 PM: Binance: "Binance will cover all losses," with all deposits and withdrawals suspended (X)
Quick explainers
- Hot wallet: an always-online exchange wallet used for fast withdrawals.
- EIP-7702: lets a regular Ethereum wallet hand control to a smart contract, signed with that wallet's own key.
- Stablecoin freeze: the issuer blocks an address so its tokens can't move. ETH and BTC can't be frozen.
- Tornado Cash: a mixer that hides where ETH came from.
- THORChain: a cross-chain swap network.
- SAFU: Binance's emergency fund for user losses.
What happened
The attacker used an EIP-7702 delegation to point the wallet Etherscan labels Binance 14 at their own "sweeper" contract. Here's what I found on Etherscan:
- 4:20 PM ET: the relayer submitted 50 pre-signed EIP-7702 authorizations for Binance 14, and only 1, nonce 18914809, went through (tx).
- 4:24 PM ET: Binance 14 was swept in 1 transaction, including 167,464.24 ETH (tx). 24 seconds later, Binance 16 sent 28,005.6 ETH to the same address (tx).
- 4:41 PM and 4:59 PM ET: the relayer used Binance 14 to pull 780 million USDC (tx) and 43 million more (tx) out of Binance Hot Wallet 34 (0xEe7a...4055).
- 5:04 PM ET: a second sweep of Binance 14 took 1,699.92 ETH (tx).
A lot of people's first take was that 7702, the new Ethereum feature, was to blame. But 7702 only works when the wallet's own key signs off, and Gnosis co-founder Martin Köppelmann wrote that it "was NOT the root cause." Inca Digital says all 50 authorizations were validly signed with Binance 14's key, so 7702 was the tool the attacker used, not the way in.
View the 50 EIP-7702 authorizations on Etherscan
Here's the part that got me: Binance's own systems kept refilling a wallet the attacker still controlled. At 7:55 PM ET, a Binance deposit address (0xEae7...A4F4) sent about 2,962 ETH into Binance 14, which was still delegated to the attacker's contract (tx). 60 seconds later, the relayer called "sweep" and moved 2,961.91 ETH to 0xA97b...8d10, an unlabeled address Binance 14 first funded during the attack (tx). It had already swept smaller deposits at 5:44 PM ET (tx) and 6:39 PM ET (tx). As long as that delegation stays live, anything landing in Binance 14 can be swept without a new signature.
At 8:13 PM ET Binance said "Binance will cover all losses" and suspended all deposits and withdrawals while it "conducts security checks, freezes funds, and works with law enforcement."
How much is gone?
Binance hasn't given a number. Arkham, a blockchain analytics platform that labels and tracks wallets, puts it at about $5 billion. At 6:47 PM ET, Arkham posted a public tracker for "the $5B Binance hack," grouping the attacker's wallets under the name "binance-hacker-1029". Some tallies go as high as $5.57 billion by counting Bitcoin and Tron outflows too, per Decrypt, but those aren't confirmed as the attacker's. Even Arkham's $5 billion is more than 3 times Bybit's roughly $1.5 billion, the previous record.
"Loss might be a bit higher than that, but will cover." CZ (X)
Who froze what
Most of the haul was stablecoins, and stablecoins can be frozen.
- Tether: More than 1.567 billion USDT — Source: CEO Paolo Ardoino, 5:25 PM ET
- Circle: More than 800 million USDC, "in coordination with law enforcement" — Source: CEO Jeremy Allaire, 5:18 PM ET
- Ripple: About 200 million RLUSD — Source: Binance co-CEO Yi He, 6:08 PM ET
- World Liberty Financial: $27 million in USD1, plus 48 million WLFI (about $2 million) — Source: Zach Witkoff (USD1), 6:15 PM ET, and Yi He (both), 6:22 PM ET
- Total: $2.54 billion verified frozen — Source: Binance, 7:22 PM ET
The 4 rows add up to roughly $2.6 billion. Binance posted its $2.54 billion after the Ripple and World Liberty posts and said it works with "issuers" and others on freezes, so my read is that the total already includes them. I'm not stacking it on top, and Binance hasn't published a breakdown.
On Etherscan, I can see Tether blacklisted the receiving address at 5:01 PM ET (tx), along with 2 wallets the attacker had already sent USDT to (tx, tx). Circle blacklisted it at 5:05 PM ET (tx).
Aave froze its DAO-run V3 and V4 markets at 6:44 PM ET as a precaution, saying its contracts are unaffected and users can still withdraw and repay.
On covering losses, Binance's SAFU fund was converted into 15,000 BTC in February, per Binance, roughly $1.2 billion at current prices. Binance hasn't said whether it will tap SAFU, its balance sheet, or both.
Where the money is going
On Etherscan, I can see the attacker parked 195,460 ETH in a fresh wallet at 4:38 PM ET (tx). That wallet, 0x8532...43d4, hasn't sent anything out yet. Other tokens are being split into new wallets, like PEPE at 5:49 PM ET (tx) and LINK at 6:34 PM ET (tx).
ETH can't be frozen, so the attacker is also swapping freezable tokens into ETH through Uniswap and borrowed 19,762 ETH on Aave against USDT, per Decrypt. After Bybit, Lazarus moved most of the stolen ETH into Bitcoin through THORChain, so that's the move I'm watching for.
Confirmed: Binance blocked a Lazarus-style campaign 2 days earlier
On Oct 27, Binance said its security team had blocked multiple North Korea-linked attacks over the previous week, with no system damage or asset losses, and warned that the "Contagious Interview" campaign is still active, per Odaily, ChainCatcher and TokenPost.
Contagious Interview uses fake recruiters and a "coding test" that installs backdoors to steal tokens, cloud credentials, signing keys and wallets, per Microsoft. Fireblocks and others tie it to Lazarus.
My theory: blocking the payload isn't the same as kicking them out
This is my opinion, not a finding. Nobody official has linked these 2 events.
Here's my read. Stopping a payload isn't the same as proving nobody got in quietly before that. Contagious Interview is built for quiet first access: 1 developer runs 1 "test," a backdoor grabs credentials, and nothing visible happens for days. If 1 earlier attempt slipped through, blocking the later ones wouldn't undo it.
The Bybit blueprint. Per Sygnia, Lazarus compromised a Safe{Wallet} developer's Mac on Feb 4, 2025, used a hijacked AWS session token to plant malicious code on Feb 19, and stole the funds Feb 21. That's 17 days, through a supplier. Sygnia also warned Lazarus plants persistence, so partial cleanup can leave the door open.
The timing fits a rush. Binance went public on Oct 27, the relayer got funded early Oct 28, and the drain hit Oct 29. An attacker with access who saw their target announce it had spotted them would have every reason to move before a full sweep.
The maintenance timing looks tactical to me. Binance scheduled Ethereum wallet maintenance for Oct 28 from about 2 AM to 3 AM ET, per its announcement. The relayer's first Tornado Cash funding landed at 3:39 AM ET, about 40 minutes after that window ended. The drain came about 37 hours later.
My read is "coast is clear." Teams watch hardest during maintenance, and once it ends, alerts can be noisy or still getting retuned. It makes sense that would be a good time for an attacker to start setting up. It's the same tactical streak Lazarus showed with Bybit, working the hours of the developer whose access they'd taken and pulling their code about 2 minutes after the theft.
2 ways I can square the 37 hour gap:
- The funding was quiet prep timed for right after maintenance, and the Oct 27 announcement was the pressure to cash out before a deeper sweep.
- The maintenance changed something they had to wait out or work around before they could get the signatures they needed.
To be clear, nobody has confirmed any link between the maintenance and the attack. This is me connecting timestamps.
The signatures point at the signing system. 50 pre-signed approvals, a second wallet signed with its own key, and possibly Bitcoin moving too. Bitcoin has no 7702 trick, so if those BTC outflows are confirmed as the attacker's, someone had signing power beyond Ethereum. To me that points to whatever Binance uses to sign, exactly where stolen developer credentials could lead.
Where I could be wrong. It could be an insider, a different supplier or a different group. But the pattern looks a lot like Bybit, and until Binance's post-mortem or a security firm names who did it, nobody knows for sure.
What I'm watching:
- Binance's promised post-mortem, and whether it names an entry point or a supplier.
- Whether the ETH heads to THORChain.
- An FBI or security firm attribution.
- Whether anything changed in Binance's Ethereum signing setup during the Oct 28 maintenance.
Key takeaways
- Binance says $2.54 billion is frozen and it will cover all losses.
- The attacker had valid Binance signatures, and the delegation let them keep sweeping deposits into Binance 14.
- My theory, not a finding: last week's block may have missed an earlier foothold, and the maintenance timing looks tactical.
I'll update this as Binance shares more. If you've spotted something on-chain I should look at, drop it in the Telegram.
Written by JUST G
JUST G covers DEX trading, memecoins, and on-chain drama for The Blockchain Gods. Join the community: