In a comprehensive incident report dated November 3, Binance disclosed that the attackers masqueraded as a recruitment officer to install malware on an engineer’s work computer. Following the breach, an internal AI tool was compromised and utilized to access the wallet-signing service. TRM Labs, a blockchain intelligence firm, linked the attack early on to the North Korean-associated group known as TraitorTrader. This attribution is backed by both on-chain and off-chain data.