Binance says fake job interview led to $6.3 billion hack

Binance said Tuesday that attackers used a fake job interview to gain access to its systems before stealing about $6.3 billion in crypto, in what the exchange described as a months-long campaign. The account, reported by CoinDesk, adds detail to a theft blockchain firms have called the largest on record.

How did the attackers get inside Binance?

Binance security chief Jimmy Su said a software engineer was approached in September by someone posing as a project director, then interviewed by a fake HR representative. The engineer downloaded a coding assignment containing malware onto a work computer, Su said.

A separate engineer had installed a tampered Homebrew package in June while looking for an AI tool, according to Binance. The exchange said attackers later used an internal AI tool and stolen credentials to reach wallet engineers’ computers.

How were the funds transferred?

Attackers deployed a container and malicious script on Oct. 29, and funds began leaving Binance wallets at 20:05 UTC, CoinDesk reported. Binance said the attackers used Ethereum’s EIP-7702 feature to gain execution rights over a hot wallet and make unauthorized transfers.

Because Binance’s hot wallets use multiparty computation, no single key could revoke those permissions, Su said. The attack affected hot-wallet infrastructure; Binance co-CEO Richard Teng said most customer assets are held in offline cold wallets.

What has Binance done since the theft?

Teng said about $2.85 billion in assets had been frozen and Binance had replenished about 98% of affected tokens with company funds. The exchange said users would not be affected and that it would bring in independent experts to review the incident.

Binance said the FBI attributed the campaign to North Korea, according to CoinDesk. The exchange said it would continue working with law enforcement and conducting its investigation.

Sources and documents

• CoinDesk — coindesk.com