Binance says fake job interview led to $6.34B hack

Binance says a fake job interview helped hackers reach its wallet systems before about $6.34 billion in digital assets was affected in an October 29 attack. In a Reuters report, the exchange’s account shows how a recruitment scam became one step in a months-long breach that led to unauthorised withdrawals.

How did the fake interview reach Binance’s systems?

Binance’s initial incident report says a person posing as a project director contacted one of its software engineers in September through a legitimate job platform. The engineer’s profile mentioned their Binance work. A supposed human resources representative held a video interview, then a supposed chief executive of a made-up company conducted a second interview through a chat app.

During that second interview, the engineer was asked to download a coding assignment to their work computer. Binance says the code contained malware, which ran during setup and went undetected by the company’s endpoint security tools.

The fake interview was part of a wider effort. Binance says an earlier incident in June exposed roles on its wallet team after an engineer downloaded a tampered developer tool. On October 20, attackers used the compromised engineer’s computer and an internal AI tool to gain control of two other employees’ systems.

How did the attackers move the crypto?

Binance says the attackers used stolen access to reach its wallet signing service, which approves transactions. On October 29, they used that access to start transfers outside the normal withdrawal process. The exchange’s report says five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC. Other transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC.

The attackers also used Ethereum’s EIP-7702 authorization system, which lets an account grant some actions to a smart contract. Binance says attackers used 50 signing transactions to set up those permissions, letting transfers continue even after the exchange suspended withdrawals. The final unauthorised transfer, 2,961.9 ETH, completed at 23:56 UTC.

How much has Binance recovered or replaced?

Binance reported that about $2.85 billion had been frozen or intercepted as of November 3, subject to reconciliation and price changes. It said it would cover the losses, and that 98% of the affected token assets had been replenished by October 31. The investigation is ongoing, and Binance says independent security firms will review its findings.

The FBI has attributed the incident to North Korea, according to Binance’s report. The scale of the loss and the long chain of access steps show how a seemingly routine job interview can become a route into an exchange’s systems.

References

• Reuters report — reuters.com
• initial incident report — binance.com