Binance Report Traces Its $6.34 Billion Hack to a Fake Job Interview
The exchange's first incident report describes a months-long campaign. It ran through a tampered download, a rigged coding assignment and an abused internal AI tool.
Binance published its initial incident report on the Oct. 29 hack on Tuesday. The exchange says about $6.34 billion in assets were affected. Roughly $2.85 billion has been frozen or intercepted. Binance says it is covering the losses, and that 98% of the impacted token assets were replenished as of Oct. 31.
"It was not a single isolated breach or a simple phishing incident," Binance said, according to SecurityWeek. The report describes a campaign that took months. It compromised three engineers' computers before any funds moved.
It started in June. A wallet engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installer. Binance's security team caught it, replaced his device and reset his credentials. But the attackers had already learned what he worked on and who he worked with.
Fueled Crypto Daily
Get the news, explained, by email.
In September, a second engineer got a message from someone posing as a project director. He was invited to two interviews, one with a fake HR person and one with the "CEO" of a company that didn't exist. The second interview ended with a coding "assignment" to download onto his work computer. It hid malicious code that ran as soon as he set it up. "The 0-day malware was not detected by the endpoint security protection tools at the time," Binance said.
On Oct. 20, the attackers used that machine and an internal AI tool to take over the first engineer's system and a third engineer's system. The report doesn't say exactly how the AI tool was used. One computer held a token that allowed container deployments.
On Oct. 29, the attackers deployed a container and ran a malicious script. They used an internal wallet signing service to move XRP, SOL, OP and BTC out of hot wallets. They also abused Ethereum's EIP-7702 feature to get partial control of a hot wallet. That wallet used multi-party computation, so Binance had no single key to cancel the delegation right away. The last unauthorized transfer settled at 23:56 UTC.
On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we're making it right.
Binance says it rebuilt the affected wallet system and AI tool. It replaced devices and retired the engineers' credentials. It's hiring independent security firms to review the incident. It also plans a research fund on AI security. The exchange said it blocked 57 suspected North Korea-linked threats this year.
Chainalysis says this playbook isn't new. It has tied more than $14.3 million in losses over 18 months to similar North Korea-linked fake interview schemes. North Korea has rejected the FBI's attribution.
Founder Changpeng Zhao weighed in late Tuesday. "A hack of this scale means serious security failures occurred," he wrote.
A hack of this scale means serious security failures occurred. No platform is unhackable, but that cannot be an excuse. Every incident exposes weaknesses that should have been prevented.
Some details are embarrassing. Public explanations also simplify what appears to have been a… https://t.co/ZMAjZt2hF8
Fake recruiters target regular users too, not just exchange staff. Never download an interview "assignment" or test project onto a computer that holds crypto or wallet apps. Use a separate device, or say no. Download software only from the official site, not a search ad. Our scam-spotting guide covers more red flags.
One rule matters most. Never store seed phrases or private keys in a password manager or on a computer, phone or other electronic device. Keep them offline on paper or metal. If anything is ever stored digitally, use strong caution.
The French bank says attackers used its own account, not customer accounts. It validates the order of magnitude of reported losses, not a final figure.
The open-source bitcoin payment tool told merchants to shut down on Sunday. By night it had traced the attacks to old software and had no credible reports of drains on 2.4.7.
