Binance traces $6.34 billion hack to fake job interview

Binance says attackers used a fake job interview to compromise an employee’s work computer, then reached its internal wallet signing service and moved about $6.34 billion in digital assets on Oct. 29. The exchange’s initial incident report describes how a months-long intrusion turned a malicious code download into unauthorized hot-wallet transactions.

How did the fake interview reach Binance’s wallet systems?

In September, a person posing as a project director contacted a Binance software engineer through a legitimate job platform. A purported human-resources representative interviewed the engineer by video, then a supposed company CEO continued the process through a social chat app. Binance says the engineer was told to download a coding assignment onto a work computer. Its code ran during setup, replacing a legitimate development-tool component with a malicious one and communicating with an attacker-controlled server.

The interview was one stage of the campaign. Binance says a separate incident in June exposed the roles of members of its wallet team after an engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. The exchange detected that compromise, replaced the device and rotated credentials, but says the attackers retained information about the team.

On Oct. 20, attackers used the computer compromised through the fake interview and an internal AI tool to reach two wallet engineers’ computers. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. Binance says the first transfers began at 20:05 UTC.

How did the attackers move funds past normal withdrawal controls?

The attackers gained access to an internal wallet signing service, which authorizes transactions from hot wallets. Binance says the service was used to initiate transfers outside its normal withdrawal process. The CoinDesk report on Binance’s briefing also describes the use of Ethereum’s EIP-7702 authorization mechanism.

EIP-7702 lets an account delegate certain execution rights to a smart contract without revealing its private key. Binance says attackers used it to give a malicious contract partial execution rights over a hot wallet. Think of it as giving a program limited authority to act for an account: the attackers used that authority to move assets without relying on the ordinary withdrawal route.

Binance says five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC; its Solana and Optimism wallets also sent about 970,500 SOL and 44.2 million OP. Further transfers included 18,270 BTC. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC.

Why did suspending withdrawals not stop the transfers?

The authorizations were recorded on-chain, so suspending Binance’s withdrawal service did not cancel them. The exchange says its hot wallets use multi-party computation, or MPC, which distributes signing authority rather than relying on one private key. That made immediate revocation more complex. Binance says it cleared the malicious delegation at 00:10 UTC on Oct. 30.

The FBI separately attributed the theft to North Korea and said the stolen assets were being converted primarily into Ether. Binance’s Nov. 3 report said about $2.85 billion had been frozen or intercepted and that 98% of affected tokens had been replenished by Oct. 31. The exchange said it would cover the loss and is bringing in independent cybersecurity firms to review the incident.

Sources and documents

• initial incident report — binance.com
• CoinDesk report on Binance’s briefing — coindesk.com