Binance traces $6.34 billion hack to fake job interview

$6.34 billion in digital assets was affected in Binance’s October 29 hack. The exchange says a months-long attack began with a fake job interview and ended with unauthorised transfers from its hot wallets.

In an initial incident report published by Binance on November 3, the exchange said attackers combined social engineering, malicious software and compromised internal systems. Binance says it will cover the losses, and 98% of the affected tokens had been restored by October 31.

How did the fake interview reach Binance’s systems?

In September, an engineer whose profile mentioned Binance was contacted on a legitimate job-search platform by someone posing as a project director. Binance says the engineer took two interviews: one with a supposed human resources representative by video, then another with someone claiming to be the CEO of a fictitious company.

The first interviewer shared a social media account with personal photos and videos to build trust. During the second interview, the engineer was asked to download a coding test to a work computer. Binance says the test contained a malicious code repository that ran during setup and contacted a server controlled by the attackers.

The malware used a modified development tool to run commands and evade device security software. Binance says the tools did not detect the malware at the time. The exchange described the fake interview as one stage of a wider campaign, rather than an isolated phishing attempt.

How did the attackers move funds from hot wallets?

The attack also drew on an earlier compromise. In June, Binance says, another engineer on its wallet development team downloaded a tampered installer while looking for an AI programming tool. The exchange detected an anomaly, replaced the device and renewed credentials, but says wallet-team devices and roles remained exposed.

On October 20, the attackers used the computer compromised by the fake interview and an internal AI tool to reach two wallet engineers’ systems. On October 29, they used stolen credentials to deploy a container and run a malicious script. Reuters reported the details from Binance’s initial report, including that the transfers continued for nearly four hours after the first theft.

Binance says the attackers used Ethereum’s EIP-7702 authorization mechanism to give a smart contract partial execution rights over a hot wallet. EIP-7702 lets an account delegate certain actions to a smart contract without revealing its private key. The attackers made 50 signing transactions to establish the permissions, which then worked outside Binance’s usual withdrawal system.

Five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, Binance says. Other transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC. The final unauthorised transfer, 2,961.9 ETH, was confirmed at 23:56 UTC.

What has Binance done since the theft?

Binance says it suspended withdrawals, worked with partners to freeze assets and developed a procedure to revoke the on-chain permissions. It reports that about $2.85 billion was frozen or intercepted. The exchange says it has reserved more than enough company funds to cover losses and that 98% of affected tokens had been restored by October 31.

Binance says the FBI attributes the incident to North Korea. It is rebuilding affected systems, strengthening access controls and bringing in independent cybersecurity experts to review the incident. The exchange also says it plans more investment in security monitoring and a research fund; its investigation is still ongoing.

Sources

• initial incident report published by Binance — binance.com
• Reuters reported the details from Binance’s initial report — reuters.com