Binance Links $6.3B Hack to Fake Job Interviews, Compromised AI

Hackers exploited compromised employee computers and stolen credentials to breach Binance’s wallet infrastructure, according to the exchange’s investigation.

A coding assignment from a prospective employer seemed like an ordinary part of a job interview. Instead, it was one step in a months-long cyberattack that ended with $6.3 billion stolen from Binance, raising questions about how exchanges protect themselves against threats that target their employees.

Coordinated Campaign Exploited Human and System Vulnerabilities

The attack was part of a coordinated campaign that exploited both human vulnerabilities and internal security systems, according to a postmortem released by Binance on Tuesday. The exchange’s findings detailed how hackers gradually gained access to its wallet infrastructure before the Oct. 29 theft.

According to Binance’s security report, the attack campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool. Although Binance detected the malware and replaced the affected device, the attackers had already gathered information about the exchange’s wallet team.

In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment. The malware compromised the engineer’s work computer and evaded the exchange’s security protections.

On Oct. 20, the attackers used the compromised computer and an internal AI tool to gain access to two additional engineers’ systems, obtaining deployment credentials that allowed them to install malicious software within Binance’s wallet infrastructure on Oct. 29.

The attackers then gained access to the exchange’s internal wallet-signing service, which authorizes cryptocurrency transactions. This allowed them to move funds outside the normal withdrawal process.

“This wasn’t one mistake or one breach — it was a months-long campaign,” Binance co-CEO Richard Teng said in a Tuesday post on X.

Ethereum Mechanism Complicated Recovery Efforts

Binance said the attackers also exploited Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts, enabling unauthorized transfers to continue even after the exchange suspended withdrawals. Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, complicated efforts to revoke those permissions.

The breach affected approximately $6.3 billion in digital assets, with Binance reporting that $2.85 billion had been frozen or intercepted, according to its latest accounting. The exchange said it would absorb the losses rather than pass them on to customers and had replenished 98% of the affected token assets as of Oct. 31.

The attack, the largest cryptocurrency hack in history, has been attributed to North Korean hackers by the Federal Bureau of Investigation (FBI). On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement, saying the FBI’s attribution was politically motivated and intended to damage North Korea’s international standing.