Fake interviews helped enable Binance’s $6.34B wallet theft

Binance says a fake recruitment campaign helped attackers reach its internal systems before they used wallet-signing access to take about $6.34 billion in crypto on Oct. 29. The exchange’s preliminary incident report describes a months-long operation that moved from compromised software to employee devices and then to hot-wallet transactions.

How did the fake job interview infect an employee’s computer?

In September, someone posing as a project director contacted a Binance software engineer through a legitimate job platform. The supposed employer arranged a video interview with a fake HR representative, then a second interview on a messaging app with someone claiming to be a company CEO. Near the end, the engineer was told to download a coding task onto a work computer. Binance says the task contained a malicious code repository that ran during setup and installed malware.

The interview was not the campaign’s first step. Binance says an engineer had downloaded a tampered Homebrew package in June while searching for an AI coding tool. The company detected the problem, replaced the device and rotated related credentials, but says the attacker learned the engineer’s role and the identities of colleagues on the wallet team. The fake interview then gave attackers another compromised machine and a route deeper into that team. The malware worked like a counterfeit part fitted into a legitimate tool: it could run commands while appearing to be ordinary developer software.

How did access to employee devices reach the wallets?

On Oct. 20, Binance says attackers used the compromised engineer’s computer and an internal AI tool to reach two wallet-team engineers’ computers. They found a deployment permission token on one device. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script.

That script reached Binance’s internal wallet-signing service, which authorized transactions outside the exchange’s normal withdrawal process. Binance says the attackers used Ethereum’s EIP-7702 authorization feature to give a smart contract they controlled partial execution rights over a hot wallet. In effect, the contract gained permission to carry out certain actions for that wallet without exposing its private key.

Binance says its hot wallets use multi-party computation, or MPC, so no single private key exists to revoke an authorization immediately. Suspending ordinary withdrawals also could not cancel permissions already recorded on-chain. The exchange says it had to submit further transactions to remove the malicious authorization.

What was taken, and what has Binance recovered?

Binance reported about $6.34 billion in affected virtual assets and said about $2.85 billion had been frozen or intercepted as of its Nov. 3 update. It said 98% of affected token assets had been replenished from company funds by then. The FBI separately said North Korea was responsible for more than $6 billion in virtual-asset theft from Binance on or about Oct. 29, and named the activity “TraderTraitor.”

The route matters because the theft did not start with a compromised blockchain or a flaw in a public smart contract. According to Binance, it began with a mix of compromised software and deception aimed at employees, then used stolen access to reach the systems that approved wallet transactions. The FBI says the attackers have been converting the stolen assets primarily into Ether.

Sources and documents

• preliminary incident report — binance.com