Binance says fake job interview and compromised AI tool led to $6.3B theft

Binance’s investigation says attackers used malware, stolen credentials and access to employees’ computers to reach the exchange’s wallet infrastructure. The exchange reports that $2.85 billion was frozen or intercepted.

Binance says a months-long cyberattack that began with a tampered AI coding tool and a fake job interview led to the theft of about $6.3 billion in digital assets. The exchange outlined the attack in a postmortem published Tuesday, describing how hackers compromised employee computers and obtained credentials to access its wallet infrastructure before the Oct. 29 theft.

According to Binance’s report, the campaign began in June, when an engineer downloaded a modified software package while setting up an AI coding tool. Binance detected malware and replaced the affected device, but says the attackers had already collected information about its wallet team.

In September, hackers posing as recruiters targeted another software engineer. They persuaded the employee to download malware disguised as a coding assignment, compromising the engineer’s work computer and evading the exchange’s security protections.

On Oct. 20, the attackers used that computer and an internal AI tool to access the systems of two more engineers and obtain deployment credentials. Binance says those credentials were used on Oct. 29 to install malicious software in its wallet infrastructure and reach the internal service that signs cryptocurrency transactions, allowing funds to be moved outside the usual withdrawal process.

The attackers also used Ethereum’s EIP-7702 mechanism, which lets wallets delegate transaction permissions to smart contracts. Binance said this enabled unauthorized transfers to continue after it suspended withdrawals. Its multiparty computation wallet system, which distributes control over transaction signing, made those permissions harder to revoke.

Binance’s latest accounting says $2.85 billion of the affected assets had been frozen or intercepted. The exchange said it would absorb the losses rather than pass them on to customers, and had replenished 98% of the affected token assets by Oct. 31.

The FBI has attributed the attack to North Korean hackers. On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement and called the FBI’s attribution politically motivated. Binance co-CEO Richard Teng described the incident on X as a months-long campaign rather than a single mistake or breach.

Sources: Cointelegraph.

Related articles