Skip to content
Crypto Bulletin

Markets, protocols and policy news

ID 5e0bb1

Binance says fake job interview preceded $6.34bn hack

Binance says a fake recruiter lured an engineer into downloading malware before attackers stole $6.34 billion in digital assets through compromised wallet systems.

Crypto Bulletin Newsroom 2 min read

Binance says fake job interview preceded $6.34bn hack

Binance said on Nov. 3 that attackers stole about $6.34 billion in digital assets on Oct. 29 after a fake job interview helped them compromise employees and reach its wallet systems. In its initial incident report, the exchange said the attack involved a months-long campaign and that North Korea was responsible, citing the FBI.

How did the fake interview compromise an engineer?

Binance said a software engineer was contacted in September on a legitimate job-hunting platform by someone posing as a project director. After two interviews, the engineer was asked to download a coding assignment to a work computer; Binance said its repository contained malware that ran during setup and evaded endpoint security tools.

In June, another engineer had installed a tampered Homebrew package while searching for an AI coding tool, Binance said. The exchange detected that incident and replaced the device, but said the engineer and colleagues on the wallet team remained exposed.

How did attackers move funds from Binance wallets?

Attackers used the compromised systems and an internal AI tool to reach other engineers, then used stolen credentials to deploy a container and launch a malicious script, Binance said. The exchange said attackers exploited Ethereum’s EIP-7702 authorization mechanism to give a malicious contract execution rights over a hot wallet, enabling transfers outside its normal withdrawal process.

CoinDesk’s report on Binance’s briefing said funds began leaving at 20:05 UTC on Oct. 29. Binance said the final unauthorized transfer settled at 23:56 UTC and it cleared the malicious authorization at 00:10 UTC on Oct. 30.

How much has Binance recovered or replaced?

Binance said about $2.85 billion had been frozen or intercepted as of its Nov. 3 update. It also said 98% of affected token assets had been replenished by Oct. 31, with the exchange covering the loss; the investigation and an independent security review are ongoing.

Sources