Security

Stronger

would

when

<h2 id="tldr">TLDR</h2>
<ul>
 <li>Binance revealed that hackers used a fake job interview to install malware before stealing $6.3 billion in cryptocurrency.</li>
 <li>Attackers spent months targeting Binance employees and gaining access to internal systems before the October 29 theft.</li>
 <li>The FBI attributed the Binance hack to North Korea’s TraderTraitor group, although Pyongyang denied involvement.</li>
 <li>Hackers exploited Ethereum’s EIP-7702 feature to gain control over a Binance hot wallet and transfer funds.</li>
 <li>Binance founder Changpeng Zhao warned that AI could increase cyberattacks against cryptocurrency exchanges and traditional banks.</li>
</ul>
<p>Binance said a fake job interview helped hackers steal $6.3 billion from the exchange on October 29. The Binance hack followed months of attempts to enter its systems, executives said at a media briefing Tuesday. The exchange described the theft as the largest known cryptocurrency hack to date.</p>
<h2 id="fake-job-interviews-targeted-exchange-engineers">Fake Job Interviews Targeted Exchange Engineers</h2>
<p>In September, a software engineer met a supposed recruiter through a real employment platform. A video interview and personal social media profile appeared genuine, Binance security chief Jimmy Su said.</p>
<p>A later caller posing as a chief executive sent the engineer a coding test. The download installed malware on a work computer without triggering security software, according to Su.</p>
<p>Binance also traced an earlier breach to June, when another engineer installed a modified Homebrew software package. The company replaced that device but said other wallet staff remained exposed.</p>
<h2 id="binance-hack-used-stolen-access">Binance Hack Used Stolen Access</h2>
<p>On October 20, the attackers reached two wallet engineers’ computers using the infected device and an internal AI tool. Nine days later, they deployed malicious code with stolen login details.</p>
<p>The thieves began transferring crypto at 20:05 UTC on October 29. The<a href="https://blockonomi.com/fbi-links-6-3b-binance-hack-to-north-koreas-tradertraitor-group/" rel="noopener noreferrer nofollow"> FBI linked the theft to North Korea’s TraderTraitor group</a>. Pyongyang has rejected the accusation.</p>
<p>Su said the attackers exploited Ethereum’s EIP-7702 feature to control a wallet connected to the internet. Binance needed several hours to remove that access and stop further transfers.</p>
<h2 id="zhao-urges-stronger-ai-defenses">Zhao Urges Stronger AI Defenses</h2>
<p>Binance founder Changpeng Zhao warned that artificial intelligence could make attacks on exchanges and banks more common. “The industry needs to use AI to prevent AI hacks,” he told CoinDesk.</p>
<p>Zhao offered no proof that AI drove the breach. Elliptic said stolen-fund movements appeared scripted, not directed by AI agents. Elsewhere,<a href="https://blockonomi.com/south-korea-calls-emergency-crypto-meeting-after-record-binance-hack/" rel="noopener noreferrer nofollow"> South Korean regulators urged exchanges to increase offline crypto storage</a>.</p>
<p>Zhao also called for shared security standards and closer cooperation across the industry. He said talks had started, but participants had not agreed on a plan.</p>
<h2 id="funds-frozen-as-withdrawals-return">Funds Frozen as Withdrawals Return</h2>
<p>Teng said partners had frozen about $2.85 billion of stolen assets. Binance had replaced roughly 98% of affected tokens with its own money, he said, and customers would not bear losses.</p>
<p>Binance<a href="https://blockonomi.com/binance-begins-second-withdrawal-phase-as-exchange-outflows-slow/" rel="noopener noreferrer nofollow"> began a second phase of crypto withdrawals</a> on Tuesday as customer outflows slowed. Teng reported $10.97 billion in withdrawals and $5.28 billion in net outflows over 46 hours. The exchange plans an independent security review and said it blocked 57 suspected North Korea-linked attacks this year.</p>
<p>The post <a href="https://blockonomi.com/binance-hack-investigation-reveals-how-attackers-bypassed-security/" rel="noopener noreferrer nofollow">Binance Hack Investigation Reveals How Attackers Bypassed Security</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Binance Hack Investigation Reveals How Attackers Bypassed Security

Table of Contents

Blockonomi

Other articles published on Nov 3, 2026

Join our free newsletter for daily crypto updates!