Binance Says $6.34 Billion Theft Began With Fake Job Interviews

Binance says the theft of $6.34 billion in assets on Oct. 29 followed a five-month operation that began with a tampered software download and later used fake job interviews to target employees. The exchange outlined the attack in its first public incident report, released Tuesday alongside a briefing by co-CEO Richard Teng and chief security officer Jimmy Su.

According to the report, an initial foothold came in June, when a wallet DevOps engineer downloaded a modified installer for a popular AI coding tool. Binance detected an anomaly, replaced the device and changed credentials, but said the incident revealed the engineer’s role and the names of colleagues on the wallet team.

In September, another engineer was approached through a legitimate job platform by someone posing as a project director. After video interviews with people claiming to represent human resources and the company’s leadership, the engineer was given a coding assignment to install on a work computer. Binance says the repository contained a malicious replacement for a legitimate software component and created a connection to an attacker-controlled server. Its endpoint security tools did not detect the malware at the time.

The attackers later used the compromised machine and an internal AI tool to reach two more wallet engineers. On Oct. 29, they logged into another engineer’s computer, deployed a container using stolen credentials and began transferring assets. Binance says the operation also involved malware designed to evade endpoint detection.

The report says five hot wallets sent 233.46 million XRP to an attacker’s address between 20:05 and 20:09 UTC. Transfers of about 970,500 SOL and 44.2 million OP followed, along with 18,270 BTC from a Binance hot wallet.

The attackers also used Ethereum’s EIP-7702 to give a smart contract controlled by them partial authority over a Binance hot wallet. Binance says suspending withdrawals did not block this route because the attackers had submitted 50 signing transactions that created on-chain delegations outside its withdrawal infrastructure. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC. Binance cleared the delegation at 00:10 UTC on Oct. 30.

Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens using its own funds, with the remainder being purchased on the open market. The company said it has rebuilt the wallet system and internal AI tool in new environments, replaced affected devices, revoked credentials and expanded behavioral anomaly detection. It is also commissioning an independent review and increasing investment in security for endpoints and developer environments.

The FBI has attributed the attack to North Korea, according to Binance’s report, which does not make its own attribution. North Korea rejected the claim on Monday. Binance said it had blocked 57 other suspected North Korea-linked attempts this year that used similar approaches.

Sources: Bitcoin Magazine.