News for hackers. Stuff that matters.

A comment on North Korean fake job interview led to $6.3B Binance heist. Parent comment

Re:North Korean fake job interview led to $6.3B Binance heist by yobananaboy on Wednesday November 04, 2026 @01:01PM (#50369222)
Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
[ Parent | on HN ]
Re:North Korean fake job interview led to $6.3B Binance heist by tennysont on Wednesday November 04, 2026 @04:26PM (#50371800)
From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.

[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail

[ Parent | on HN ]
Re:North Korean fake job interview led to $6.3B Binance heist by stogot on Wednesday November 04, 2026 @07:27PM (#50373385)
Is quorum signing not a thing in crypto?
[ Parent | on HN ]
Re:North Korean fake job interview led to $6.3B Binance heist by cowlevel on Wednesday November 04, 2026 @08:37PM (#50373950)
In Ethereum it would be implemented by overriding your account with a smart contract, the approval of which is exactly what they signed here (only it wasn't a multisig smart contract, it was something malicious).
[ Parent | on HN ]
Re:North Korean fake job interview led to $6.3B Binance heist by tennysont on Thursday November 05, 2026 @02:39AM (#50376283)
It is---though I don't see the connection
[ Parent | on HN ]
Re:North Korean fake job interview led to $6.3B Binance heist by yobananaboy on Friday November 06, 2026 @10:49AM (#50393857)
They had to sign 50 of them because they had to compete timing the transaction with the normal transactions. Transactions have to be in nonce order for the wallet, and if two transactions with the same nonce are submitted to a block, it is up to the miner / validator to determine which one to put in. So if you spray 50, you can almost guarantee that the transaction you want will get in.
[ Parent | on HN ]