Binance Details How a Fake Job Interview Led to $6.34B Heist

Binance said Tuesday that the $6.34 billion theft had its starting point in a fake job interview, with five months passing before any funds moved. It was the exchange’s first public account of the Oct. 29 attack.

Binance also released an initial incident report, paired with a media briefing by co-CEO Richard Teng and chief security officer Jimmy Su, that describes a campaign including a poisoned software download, a staged recruitment process, malware that got past endpoint detection and an internal AI tool used against the company’s own wallet engineers.

Roughly $2.85 billion of the stolen assets have been frozen or intercepted, Binance said, and 98% of the affected tokens have been replenished from its own funds, with the rest bought on the open market.

“This wasn’t one mistake or one breach — it was a months-long campaign,” Teng wrote on X. “We’re publishing the full report because the lessons go far beyond Binance.”

The FBI has tied the attack to North Korea. Binance’s report notes that finding without adopting it. On Monday, Pyongyang rejected the claim, with Kim Yo Jong, sister of leader Kim Jong Un, calling it a “grave political provocation” in state media.

Five months of preparation preceded the Binance heist

The first foothold, per Binance, came in June. A wallet DevOps engineer looked for a popular AI coding tool and installed a tampered Homebrew installer.

Binance’s security team spotted the irregularity, swapped the device and rotated credentials. The episode nevertheless disclosed the engineer’s role and the names of colleagues on the wallet infrastructure team.

In September, another engineer was contacted on a genuine recruitment platform by someone presenting as a project director. A video interview with an alleged HR representative followed, during which the interviewer shared a personal social media account to gain credibility. A second conversation with a supposed CEO ended with an “assignment”: a code repository the engineer was instructed to install on his work machine.

The repository replaced a legitimate pyenv component with a malicious version and created a link to a server controlled by the attackers. Binance says its endpoint tools did not flag the zero-day malware at that point.

On Oct. 20, the intruders used that machine and an internal AI tool to get to two more wallet engineers, one of whom had a container deployment token. On Oct. 29, between 17:15 and 19:56 UTC, they entered a third engineer’s computer, used the stolen credentials to deploy a container, and began the drain. Binance says it blocked 57 other suspected North Korea-linked attempts using similar lures this year.

Containment took four hours

The assets moved quickly. From 20:05 to 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address. Solana and Optimism wallets then moved about 970,500 SOL and 44.2 million OP, and a Binance hot wallet sent 18,270 BTC.

The attacker used the compromised signing service to activate Ethereum’s EIP-7702, which permits an account to delegate execution rights to a smart contract without exposing its key, and handed an attacker-controlled contract partial control of a Binance hot wallet.

The withdrawal suspension did not close that final route. The attackers had already submitted 50 signing transactions to set up on-chain delegations running outside Binance’s withdrawal infrastructure. Because the wallet employed multi-party computation, no single key existed to revoke them, forcing the team to create a procedure on the fly. The last unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC.

The delegation was cleared by Binance at 00:10 UTC on Oct. 30.

The report concedes the problem. “These challenges extended the time required to fully contain the unauthorized asset movements,” it says, and goes on to say the company is reviewing its signing policy coverage and hot wallet controls.

Customers took out $10.97 billion in the 46 hours after withdrawals reopened Sunday, leaving net outflows of $5.28 billion, according to data Teng shared Tuesday. By 03:00 UTC, hourly deposits had overtaken withdrawals, a shift Teng called a sign of stabilization. On Tuesday, Binance restored withdrawals for dozens more assets across nine networks.

The breach has become a subject of debate in Washington. CFTC Chairman Michael Selig said the hack “proves our exact point” about the need for a federal registration path for offshore exchanges, and the agency on Tuesday approved equity perpetual futures for U.S.-regulated venues, extending the onshoring drive that began with Kalshi’s bitcoin perp in May.

The wallet system and the internal AI tool have been rebuilt in fresh environments, Binance says; affected devices were replaced, the engineers’ credentials revoked, and behavioral anomaly detection expanded.

An independent review is being commissioned, spending on endpoint and developer-environment security is being increased, and outside firms are being brought into a planned research fund for AI security. Certain technical details will remain private, the report says.