Binance says fake job interview preceded $6.34 billion hack

Binance said on Nov. 3 that attackers used a fake job interview to help steal about $6.34 billion in crypto from its wallets on Oct. 29, exposing how a recruitment scam became part of a months-long breach. The exchange’s initial incident report says the attackers also used malicious software and access to internal systems.

• $6.34 billion in digital assets were impacted, Binance said.
• About $2.85 billion had been frozen or intercepted as of the report.
• The theft began with transfers from five hot wallets at 20:05 UTC.
• Binance said 98% of affected tokens had been replenished by Oct. 31.

How did a fake job interview give attackers access?

In September, an engineer was contacted on a legitimate job platform by someone posing as a project director, Binance said. After a video interview with a purported HR representative, the engineer was invited to a second interview with someone claiming to be the CEO of a fictitious company.

During that second interview, the engineer was told to download a coding assignment onto a work computer. Binance said the repository contained malware that ran during setup, replaced part of a legitimate development tool and evaded the company’s endpoint security software.

The job approach was one stage of a wider campaign. Binance said another engineer had downloaded a tampered software package in June while searching for an AI coding tool. The exchange detected that earlier compromise, replaced the device and changed credentials, but said the employee’s role and colleagues on the wallet team had been exposed.

How did the attackers reach Binance’s wallets?

On Oct. 20, Binance said, attackers used the compromised engineer’s computer and an internal AI tool to reach two wallet engineers’ computers. Nine days later, they used stolen credentials to deploy a container and run a malicious script, which gained access to an internal wallet-signing service.

That service let the attackers authorize transactions outside Binance’s usual withdrawal process. The company’s report says five hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC. Other transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC.

Binance said the attackers then used Ethereum’s EIP-7702 mechanism to give a malicious smart contract permission to move assets from a hot wallet. A smart contract is code that runs on a blockchain. The exchange said the permission was already active on-chain, so suspending withdrawals could not stop every transfer. Its report to Reuters says the final unauthorized transfer cleared nearly four hours after the first.

What does Binance say about the losses?

Binance said the FBI attributed the incident to North Korea. The exchange described its own findings as initial and said the investigation was ongoing, with independent cybersecurity experts due to review the report.

The exchange said it would absorb the financial impact rather than pass losses to users. As of Oct. 31, it said it had replenished 98% of the affected tokens and was purchasing the remaining, less liquid assets. Binance also said it had frozen or intercepted about $2.85 billion, a figure subject to reconciliation and market price changes.

Binance said it rebuilt affected systems, replaced devices and revoked credentials and tokens linked to the compromised engineers. It plans to expand detection and wallet controls while the investigation continues.

Sources and documents

• initial incident report — binance.com
• report to Reuters — live.euronext.com