Skip to main content
Blockfront

Crypto markets, protocols and policy

Binance says fake job interview preceded $6.34B hack

Binance says a fake recruitment process helped attackers compromise staff and steal $6.34 billion, exposing the exchange’s wallet systems.

Blockfront Editorial

2 min read

Binance says fake job interview preceded $6.34B hack

Binance said on Nov. 3 that attackers stole $6.34 billion in digital assets in an Oct. 29 breach after months of preparation that included a fake job interview. The exchange’s initial incident report says the FBI attributed the attack to North Korea.

How did the fake interview reach Binance’s systems?

In September, a person posing as a project director contacted a Binance software engineer through a job-hunting platform, the exchange said. After two interviews, the engineer was asked to download a coding assignment to a work computer; Binance said its code contained malware that evaded endpoint security.

Binance said attackers used the compromised computer and an internal AI tool on Oct. 20 to reach two wallet engineers’ devices. The report also traces an earlier foothold to June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool.

How did the attackers move the funds?

On Oct. 29, attackers used stolen credentials to deploy a container and run a malicious script, Binance said. They gained unauthorized access to an internal wallet signing service and used Ethereum’s EIP-7702 mechanism to give an attacker-controlled smart contract execution rights over a hot wallet.

Binance reported that transfers began at 20:05 UTC and that five hot wallets sent 233.46 million XRP within four minutes. The attack also moved assets including SOL, OP, BTC and ETH; Binance said the final unauthorized transfer settled at 23:56 UTC.

What is Binance doing after the breach?

Binance said it had frozen or intercepted about $2.85 billion and replenished 98% of affected tokens by Oct. 31, using company funds to cover the loss. It said users would not bear the financial impact.

The exchange said it closed identified entry points, rebuilt affected systems and would bring in independent cybersecurity experts to review the incident. Its investigation remains ongoing.

Sources and documents