Binance says fake job interview preceded $6.34B hack

Binance says attackers used a fake job interview to compromise an engineer and help steal about $6.34 billion in digital assets from its hot wallets on Oct. 30. The exchange’s preliminary incident report says the interview was one step in a months-long attack that also reached internal systems.

How did the fake job interview compromise Binance?

In September, a person posing as a project director contacted a Binance software engineer through a legitimate job platform, the company said. After two interviews, the purported employer asked the engineer to download a coding assignment to a work computer; Binance says its code contained malware that evaded endpoint security tools.

Binance said attackers used that compromised computer and an internal AI tool on Oct. 20 to access two other engineers’ devices. They then used stolen credentials to deploy a container and run a malicious script against the exchange’s wallet signing systems.

How did the attackers move funds?

Binance says attackers bypassed normal withdrawal processes and used Ethereum’s EIP-7702 authorization mechanism to give a smart contract execution permissions over hot wallets. The exchange reported that about $6.34 billion in digital assets were affected.

Binance’s report says attackers continued transferring assets after withdrawals were suspended because the malicious authorizations already existed on-chain. The exchange said it froze or blocked about $2.85 billion, and had replenished 98% of affected tokens by Oct. 31.

What happens next in Binance’s investigation?

Binance said it will bring in independent cybersecurity experts to review the incident and recommend further security improvements. The exchange also said it is continuing to trace affected assets with law enforcement, blockchain intelligence firms and industry partners.

Source material

• preliminary incident report — binance.com