Binance traces $6.34 billion theft to fake job interview

Binance says attackers stole about $6.34 billion in digital assets after a months-long campaign began with a fake job interview and reached the exchange’s wallet signing systems. The exchange’s November 3 incident report describes how malware on an engineer’s work computer helped attackers reach other staff and deploy a script that initiated unauthorized transfers. Binance says the investigation is ongoing.

How did the fake interview lead inside Binance?

In September, a person posing as a project director contacted a Binance software engineer through a legitimate job-hunting platform. Binance says the engineer had listed his Binance experience on the platform. A supposed human resources representative held a video interview and shared a social media account with personal photos and videos to build trust. In a second interview, someone claiming to be the CEO of a fictitious company asked the engineer to download a coding assignment to his work computer.

The assignment contained a malicious code repository. Binance says its code ran during setup, replaced a legitimate development tool component with a malicious version, and connected to an attacker-controlled server. The malware evaded the endpoint security tools then in use.

This was one part of the campaign. In June, another wallet team engineer had downloaded a tampered Homebrew installation while searching for an AI coding tool. Binance detected the anomaly, replaced the device and rotated related credentials, but says the attackers learned about that engineer’s role and colleagues. On October 20, they used the compromised computer and an internal AI tool to reach two more engineers’ computers, including one holding a container deployment permission token.

How did access to computers move the crypto?

On October 29, attackers used stolen credentials to access an engineer’s computer, deploy a container and run a malicious script. Binance says the script reached its internal wallet signing service, which authorizes transactions for hot wallets. The attack therefore moved from compromised employee devices into the system that signs wallet transactions.

According to CoinDesk’s account of Binance’s briefing, the attackers used Ethereum’s EIP-7702 authorization mechanism to give a smart contract execution rights over a hot wallet. Think of it as giving a program limited permission to act for an account: the private key itself need not be exposed for the program to move assets within those permissions. Binance says the transfers bypassed its normal withdrawal process.

Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Binance also reports transfers of about 970,500 SOL and 44.2 million OP, followed by 18,270 BTC. Its report says the attacker used 50 signing transactions to establish malicious authorizations. Because Binance’s wallets use multi-party computation, there was no single key that could immediately revoke them. Binance says the final unauthorized transfer settled at 23:56 UTC; it cleared the delegation at 00:10 UTC on October 30.

What does Binance say has been recovered or replaced?

Binance reported that about $2.85 billion in assets had been frozen or intercepted, subject to reconciliation and market-price changes. It also said 98% of the affected token assets had been replenished with company funds as of October 31. Replenishment is not the same as recovering the stolen assets. The exchange says it will absorb the financial impact and has engaged independent cybersecurity experts to review its findings. Its report attributes responsibility to North Korea based on information released by the FBI, while noting that the investigation and independent review are still underway.

Sources and documents

• November 3 incident report — binance.com
• CoinDesk’s account of Binance’s briefing — coindesk.com