Binance says fake interview led to $6.34 billion theft

Binance said on Nov. 3 that attackers stole about $6.34 billion in digital assets on Oct. 29–30 after a fake job interview helped them compromise an employee’s computer. The exchange’s preliminary incident report says the attackers used the breach to reach its wallet systems.

How did the fake interview compromise the employee?

In September, a person posing as a project director contacted a Binance software engineer through a job platform, the exchange said. After two interviews, someone claiming to be the fictitious company’s CEO asked the engineer to download a coding assignment onto a work computer; its repository contained malware that Binance said evaded endpoint security.

Binance said the attackers used the compromised computer and an internal AI tool on Oct. 20 to access two other engineers’ devices and obtain credentials. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script against the exchange’s wallet signing service.

How did the attackers move the funds?

The attackers used Ethereum’s EIP-7702 authorization mechanism to give a smart contract they controlled execution permissions over Binance hot wallets, according to the company. That let them transfer assets outside normal withdrawal processes; Binance said withdrawals alone could not stop transfers already authorized on-chain.

CoinDesk reported that Binance said the FBI attributed the attack to North Korea. Binance’s report puts the amount frozen or blocked at about $2.85 billion, and says 98% of affected token assets had been replenished by Oct. 31.

What happens next?

Binance says it has rebuilt affected wallet systems and internal AI tools, replaced devices and disabled credentials tied to the engineers. It is inviting independent cybersecurity firms to review the incident and says the investigation is ongoing, according to its report.

Source material

• preliminary incident report — binance.com