Binance Hack: Fake Job Interviews Helped Hackers Steal $6.34 Billion

Listen to this article

Press play to start listening

Binance explains how North Korean hackers used fake job interviews, malicious developer tools and an internal AI tool in its $6.34 billion cryptocurrency theft.

Binance says a fake job interview process and abuse of an internal AI tool helped attackers reach its wallet infrastructure before the October 29, 2026 theft of $6.34 billion in cryptocurrency. Its initial incident report, published on November 3, traces the campaign through the compromised devices of three engineers.

As Hackread.com previously reported, theFBI attributed the attackto North Korea.

The exchange has stated that it would cover the financial losses. Binance co-CEO Richard Teng addressed concerns over the financial impact ina statement on X, saying, “We are committed to covering all hacked losses through our company funds. Your assets are safe.”

On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we're making it right.No user bears the loss. We set aside more than the full amount…https://t.co/BDmr3wLzOP

In its latestincident report, Binance traced the campaign back to June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while searching for anAI coding tool. Although Binance detected the activity, replaced the device and rotated credentials, the attackers learned the employee’s role and connections within the wallet team.

In September, another engineer, identified as Engineer B, was approached through a job-hunting platform by someone posing as a recruiter. The second interview ended with Engineer B being asked to download a coding assignment onto his work laptop.

Binance says the repository contained malware that replaced a legitimate pyenv file with a malicious one, giving attackers a way to run their own commands on the machine and contact a server they controlled.

On October 20, the attackers used Engineer B’s compromised computer and an internal AI tool to gain access to the devices of Engineer A and another wallet engineer, identified as Engineer C. Engineer A’s computer held a container deployment token. Binance has not explained how the AI tool enabled that access.

On October 29, the attackers accessed Engineer C’s computer and used credentials stolen from Engineer A to deploy a container and launch a malicious script. Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP. Wallets on Solana and Optimism subsequently sent approximately 970,500 SOL and 44.2 million OP, followed by 18,270 BTC.

The attackers also abusedEthereum’s EIP-7702account-authorization mechanism, which allows an account to delegate certain execution rights to a smart contract. This gave an attacker-controlled contract partial execution rights over a Binance hot wallet without exposing its private key.

Suspending withdrawals could not immediately stop these on-chain authorizations. Binance said its multi-party computation (MPC) wallet setup meant there was no single private key available to revoke them immediately.

The exchange acknowledged the difficulty in its incident report, stating, “These challenges extended the time required to fully contain the unauthorized asset movements.”

The final unauthorized transfer, involving 2,961.9 ETH, settled at 23:56 UTC after having been broadcast earlier and remaining pending. Binance cleared the malicious delegation at 00:10 UTC on October 30.

As of its November 3 report, Binance said approximately $2.85 billion had been frozen or intercepted, with the figure subject to reconciliation and market price changes. Separately, it said 98% of the affected token assets had been replenished by October 31.

That replenishment represents replacement assets, not the recovery of 98% of the stolen funds. Binance said it had rebuilt affected systems, replaced compromised devices and tightened access controls. The investigation remains ongoing, and independent cybersecurity firms will review its findings.

This incident follows another major North Korean-linked crypto theft. In February 2025, attackers stole approximately$1.5 billion from Bybitin an operation the FBI attributed to North Korea. Hackread.com reported on the theft and the subsequent investigationlinking it to the Lazarus Group.

Commenting on Binance’s findings, Gina Cardelli, Director of Platform and Threat Intelligence at Fortra, questioned how the compromised employee device enabled access to sensitive systems.

“My questions would be around the security controls surrounding that employee’s environment. “An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”

(Photo byBastian Riccardi)

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME