Binance details $6.34 billion hack via fake interview

Binance says hackers used a fake job interview and internal AI tools to reach its wallet systems in an incident involving about $6.34 billion in digital assets. The breach shows how employee devices and internal tools can become part of the attack path to systems that authorize crypto transfers. In its preliminary incident report, Binance said about $2.85 billion had been frozen or blocked and 98% of affected assets had been replenished as of October 31. The company said the amount remains under review and may change with market prices.

How did a fake interview reach Binance’s wallet team?

Binance’s report describes a campaign that began in June, when attackers obtained information about wallet staff after an engineer downloaded a tampered installer for Homebrew, a software package manager. Binance said its security team detected the anomaly, replaced the device and rotated related credentials, but the engineer’s role and information about colleagues had already been exposed. In September, a second engineer was approached through a legitimate job platform by someone posing as a project director. After two interviews, the engineer downloaded a coding assignment containing malicious code onto a work computer.

What role did the internal AI tool play?

On October 20, attackers used the compromised computer and internal AI tools to gain control of devices belonging to two wallet engineers, Binance said. They found a token on one device with permission to deploy containers. On October 30 in Binance’s UTC+8 chronology, attackers used stolen credentials to deploy a container from another engineer’s computer and run a malicious script. Reuters’ account of Binance’s report says the attack began on October 29, reflecting the UTC date.

Binance has not said the AI tool itself was vulnerable; its report says the attackers used it as a route to compromise other devices. It describes a chain of social engineering, malware, stolen credentials and access to wallet signing operations. Binance said it has rebuilt affected AI tools and strengthened their access controls.

How did the attackers move the funds?

Binance says attackers gained unauthorized access to its internal wallet signing service and used EIP-7702 authorizations to give a smart contract they controlled partial execution permissions over affected hot wallets. Five wallets transferred 233.46 million XRP in four minutes, followed by transfers including SOL, OP and 18,270 BTC. The attackers submitted 50 signed transactions to establish malicious delegations, which Binance said continued to operate even after it suspended withdrawals. The final unauthorized transfer, 2,961.9 ETH, was confirmed at 07:56 UTC+8 on October 30.

Binance says it has closed the entry points used, rebuilt or replaced affected systems, and invited independent cybersecurity firms to review its findings. Its investigation remains preliminary, and the company said some technical details will remain confidential. The FBI has attributed the incident to North Korea, according to Binance’s report; attribution and the final impact figures remain subject to review.

References

• preliminary incident report — binance.com
• account of Binance’s report — investing.com