The Hack Started With a LinkedIn Message, Not a Line of Code
North Korean operatives cracked the world's largest crypto exchange not by brute-forcing its servers, but by sending fake job applications — and Binance employees clicked.
Binance has confirmed that the $6.3 billion exploit now being called one of the largest in crypto history began with a social engineering campaign linked to North Korean state-sponsored hackers. Attackers posed as job candidates, built trust over months, and quietly burrowed into internal systems long before a single dollar moved.
The EIP-7702 Angle Nobody Is Explaining
Once inside, the attackers didn't use some zero-day exploit discovered in a dark web forum. They weaponized EIP-7702, a relatively new Ethereum mechanism that allows externally owned accounts to temporarily behave like smart contracts. It's a feature designed to improve user experience in the Ethereum ecosystem. The hackers turned it into a master key.
By compromising employees with access to Binance's hot-wallet signing infrastructure, the attackers were able to abuse EIP-7702 delegation logic to authorize fraudulent transactions at scale. The hot wallet, designed for speed and liquidity, became the exit door.
This is the part that should concern every exchange, every DeFi protocol, and every institutional desk running Ethereum infrastructure right now. EIP-7702 shipped with Ethereum's Pectra upgrade. It is live. It is being used. And most security teams have not fully stress-tested what happens when a compromised internal signer meets delegation-enabled accounts.
Months of Patience, One Day of Execution
Binance says the attackers operated inside its systems for months before executing the drain. That timeline matters. This was not opportunistic. It was a coordinated, state-level operation with a clear playbook, the same one used against Bybit earlier this year, the same one attributed to the Lazarus Group across dozens of prior incidents.
North Korea's crypto theft apparatus has now stolen an estimated tens of billions of dollars across multi-year campaigns. These funds reportedly flow directly into weapons development programs, which means every exchange that gets hit is, indirectly, a geopolitical event.
What Crypto Holders Should Watch Right Now
If you hold assets on any centralized exchange, the immediate question is not whether your exchange has good smart contract audits. It is whether their human access controls are airtight. Cold wallet segregation, multi-party signing thresholds, and employee verification protocols are the real attack surface.
Watch for Binance's official post-mortem on signing infrastructure changes. Watch for Ethereum core developers to address EIP-7702 delegation risks in security advisories. And watch whether regulators in the US and EU use this incident to accelerate exchange custody requirements.
The exploit was technical. The entry point was human. That combination is the hardest problem in crypto security, and it just cost $6.3 billion to prove it.