Binance said attackers in its $6.34B hack used a fake job interview to plant malware, then an internal AI tool to gain control over two wallet engineers.
Key Facts
Binance said the Oct. 29 attack on its hot wallets was a multi-stage campaign that combined fake recruitment interviews, malicious software, compromised internal AI tooling and an Ethereum authorization mechanism.
An engineer downloaded a malicious "assignment" during a fake job interview in September, and on Oct. 20 the attacker used an internal AI tool to gain control over two wallet engineers, Binance said.
About $2.85 billion of the roughly $6.34 billion taken has been frozen or intercepted, subject to reconciliation, and 98% of the affected token assets had been replenished as of Oct. 31, the exchange said.
Binance said the roughly $6.34 billion theft from its hot wallets on Oct. 29 stemmed in part from a fake job interview, after which the attacker used an internal AI tool to gain control over two wallet engineers.
The exchange published its initial findings on Tuesday, calling the breach a multi-stage campaign and "not a single isolated breach or a simple phishing incident."
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in the report, which it also posted on X.
How the Attackers Got In
The social engineering began in September, when someone posing as a project director approached a Binance software engineer through a legitimate job-hunting platform, Binance said. A purported HR representative then interviewed him over live video.
In a second interview on a chat app, the engineer was told to download an "assignment" onto his work computer. It contained malware that swapped a legitimate development tool component for a malicious one and evaded endpoint security tools at the time, Binance said.
In June, a wallet DevOps engineer downloaded a tampered Homebrew installation while installing an AI coding tool. Binance replaced the device and rotated credentials, but the engineer's role and wallet-team colleagues were exposed to the hacker, it said.
On Oct. 20, the attacker used the software engineer's compromised computer and an internal AI tool to gain control over the DevOps engineer and another wallet engineer, finding a container deployment token. On Oct. 29, it used the stolen credentials on that engineer's computer to deploy a container and launch the attack, Binance said.
Why Halting Withdrawals Didn't Stop Everything
Using an internal wallet signing service, the attacker sent 233.46 million XRP (XRP) from five hot wallets between 20:05 and 20:09 UTC, then about 970,500 SOL (SOL), 44.2 million OP (OP) and 18,270 BTC, the report said.
It then exploited the EIP-7702 authorization mechanism on Ethereum (ETH) to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations kept working onchain after withdrawals were suspended, and because the wallet used multi-party computation, there was no single private key to revoke them immediately, Binance said.
Binance said the latest FBI information indicates North Korea is responsible, and that it detected and prevented 57 suspected North Korea-linked cyber threat cases this year.
Binance, which says users will not bear the losses, reserved over $6.34 billion to cover them and resumed withdrawals in phases on Nov. 1. It said it has rebuilt the affected wallet system and AI tool and is engaging independent security firms.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
