Skip to content
Crypto Bulletin

Markets, protocols and policy news

ID f1a843

Binance says fake job interview preceded $6.34B hack

Binance says a fake recruitment process helped attackers breach its wallet systems and steal $6.34 billion, prompting the exchange to replenish user assets.

Crypto Bulletin Newsroom 2 min read

Binance says fake job interview preceded $6.34B hack

Binance said on Nov. 3 that attackers stole about $6.34 billion in digital assets on Oct. 29 after a fake job interview helped them compromise an employee’s work computer and reach the exchange’s wallet systems. The exchange’s initial incident report describes a months-long campaign, with findings still subject to independent review.

How did the fake interview give attackers access?

In September, a software engineer was contacted on a legitimate job platform by someone posing as a project director, Binance said. After video interviews with a purported HR representative and CEO, the engineer was asked to download a coding assignment; its repository ran malware during setup and evaded endpoint security tools.

Binance said attackers used that compromised computer and an internal AI tool on Oct. 20 to gain control of two other engineers’ computers. The campaign had begun earlier: in June, another engineer installed a tampered Homebrew package while searching for an AI coding tool. Binance detected that compromise and replaced the device, but said the attacker learned the engineer’s role and colleagues on the wallet team.

How did the attackers move funds from Binance?

On Oct. 29, attackers used stolen credentials to deploy a container and run a malicious script, Binance said. They exploited Ethereum’s EIP-7702 authorization mechanism through an internal wallet signing service, giving an attacker-controlled smart contract partial execution rights over a hot wallet.

Five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC, according to the report; transfers also included SOL, OP, BTC and ETH. Binance said the attack was attributed to North Korea by the FBI.

How much of the loss has Binance covered?

Binance said about $2.85 billion had been frozen or intercepted and 98% of affected token assets had been replenished as of Oct. 31. The exchange said it set aside more than the amount needed to cover the loss and was purchasing the outstanding, less liquid assets. CoinDesk reported Binance’s account of the fake interviews and wallet access following a company briefing.

Sources