Binance says fake job interview helped hackers steal $6.34 billion

Binance says hackers stole about $6.34 billion in crypto after using a fake job interview to compromise an employee’s work computer, turning a months-long campaign into a breach of the exchange’s wallet systems. In its initial incident report, published Nov. 3, Binance said the theft happened on Oct. 29 and that about $2.85 billion had been frozen or intercepted by the time of the update.

The company’s account links the breach to a wider chain of staff and system compromises. Reuters’ report on Binance’s findings says the FBI blamed a North Korean hacking group, while North Korea has rejected that claim.

How did the fake interview reach a Binance computer?

Binance said the job approach began in September, when an engineer who listed Binance experience on a job-hunting platform was contacted by someone posing as a project director. The engineer had a video interview with a supposed human resources representative, who shared a social media account with personal photos and videos to build trust. A second interview, with someone claiming to be the chief executive of a fictitious company, ended with a request to download a coding assignment to the engineer’s work computer.

The assignment’s code contained malware, according to Binance. The company said it was designed to evade endpoint security tools, which monitor work devices for suspicious activity. Binance also reported an earlier breach in June: an engineer on its wallet development team downloaded a tampered software package while searching for an AI coding tool. The exchange said it replaced that device and changed related credentials, but the attacker had learned about the engineer’s role and colleagues.

How did the attackers get from employee access to stolen crypto?

Binance said that on Oct. 20, the attackers used the compromised engineer’s computer and an internal AI tool to reach two wallet engineers’ systems. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. A container is a packaged environment for running software.

The attackers then misused the wallet signing service, which approves transactions. Binance said they used Ethereum’s EIP-7702 feature to give a malicious smart contract limited execution rights over a hot wallet, a crypto wallet connected to the internet. This let them move funds outside the exchange’s normal withdrawal process. Five Binance hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, the report said; transfers of other tokens followed.

What has Binance said about the losses?

Binance said it had replenished 98% of affected tokens with company funds as of Oct. 31 and was purchasing the remaining, less liquid assets. It also said it would cover the loss and was arranging an independent cybersecurity review. The investigation is ongoing, and Binance said its findings will face further review.

Sources and documents

• initial incident report — binance.com
• Reuters’ report on Binance’s findings — investing.com