{"id":247119,"date":"2026-11-03T16:44:20","date_gmt":"2026-11-03T16:44:20","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=247119"},"modified":"2026-11-03T16:44:20","modified_gmt":"2026-11-03T16:44:20","slug":"binance-says-6-34-billion-hack-began-with-fake-job-interview","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=247119","title":{"rendered":"Binance Says $6.34 Billion Hack Began With Fake Job Interview\u00a0"},"content":{"rendered":"

Bitcoin Magazine<\/a><\/p>\n

Binance Says $6.34 Billion Hack Began With Fake Job Interview\u00a0<\/a><\/p>\n

<\/div>\n

The $6.34 billion theft from Binance began with a fake job interview and ran for five months before a single coin moved, the exchange said Tuesday in its first public account of the Oct. 29 attack.<\/p>\n

Another initial incident report<\/a> from Binance, released alongside a media briefing by co-CEO Richard Teng and chief security officer Jimmy Su, describes a campaign that combined a poisoned software download, a staged recruitment process, malware that evaded endpoint detection and an internal AI tool the attackers turned against the company\u2019s own wallet engineers.\u00a0<\/p>\n

Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance being bought on the open market.<\/p>\n

\u201cThis wasn\u2019t one mistake or one breach \u2014 it was a months-long campaign,\u201d Teng wrote on X. \u201cWe\u2019re publishing the full report because the lessons go far beyond Binance.\u201d<\/p>\n

The FBI has attributed<\/a> the attack to North Korea. Binance\u2019s report cites that finding but stops short of its own attribution. Pyongyang rejected<\/a> the claim Monday, with Kim Yo Jong, sister of leader Kim Jong Un, calling it a \u201cgrave political provocation\u201d through state media.<\/p>\n

The Binance hack had five months of preparation<\/h2>\n

According to Binance, the first foothold for this hack came in June. A wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installer.\u00a0<\/p>\n

Binance\u2019s security team caught the anomaly, replaced the device and rotated credentials, but the episode exposed the engineer\u2019s role and the names of colleagues on the wallet infrastructure team.<\/p>\n

In September, a second engineer was approached on a legitimate job platform by someone posing as a project director. A video interview with a purported HR representative followed, with the interviewer sharing a personal social media account to build trust. A second interview with a supposed CEO ended with an \u201cassignment\u201d: a code repository the engineer was told to install on his work machine.\u00a0<\/p>\n

The repository replaced a legitimate pyenv component with a malicious version and opened a channel to an attacker-controlled server. Binance said the zero-day malware was not flagged by its endpoint tools at the time.<\/p>\n

On Oct. 20, the attackers used that machine and an internal AI tool to reach two more wallet engineers, one of whom held a container deployment token. On Oct. 29, between 17:15 and 19:56 UTC, they logged into a third engineer\u2019s computer, deployed a container with the stolen credentials and launched the drain. Binance said it blocked 57 other suspected North Korea-linked attempts this year using similar lures.<\/p>\n

Four hours to contain<\/h2>\n

The money left fast. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address. Wallets on Solana and Optimism followed with about 970,500 SOL and 44.2 million OP. A Binance hot wallet then sent 18,270 BTC.\u00a0<\/p>\n

The attacker used the compromised signing service to invoke Ethereum\u2019s EIP-7702, which lets an account delegate execution rights to a smart contract without exposing its key, and gave an attacker-controlled contract partial control of a Binance hot wallet.<\/p>\n

Suspending withdrawals did not stop that last channel. The attackers had submitted 50 signing transactions to establish on-chain delegations that operated outside Binance\u2019s withdrawal infrastructure. Because the wallet used multi-party computation, no single key existed to revoke them, and the team had to build a procedure on the spot. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC.\u00a0<\/p>\n

Binance cleared the delegation at 00:10 UTC on Oct. 30.<\/p>\n

The report acknowledges the gap. \u201cThese challenges extended the time required to fully contain the unauthorized asset movements,\u201d it says, adding that the company is reviewing its signing policy coverage and hot wallet controls.<\/p>\n

Customers withdrew $10.97 billion in the 46 hours after withdrawals reopened Sunday, with net outflows of $5.28 billion, according todata Teng shared<\/a> Tuesday. By 03:00 UTC hourly deposits exceeded withdrawals, a shift Teng called a sign of stabilization. Binance reopened withdrawals for dozens more assets across nine networks on Tuesday.<\/p>\n

The breach has become a talking point in Washington. CFTC Chairman Michael Selig said<\/a> the hack \u201cproves our exact point\u201d about the need for a federal registration path for offshore exchanges, and on Tuesday the agency cleared equity perpetual futures<\/a> for U.S.-regulated venues, extending the onshoring push it began with Kalshi\u2019s bitcoin perp<\/a> in May.<\/p>\n

Binance said it has rebuilt the wallet system and the internal AI tool in new environments, replaced affected devices, revoked the engineers\u2019 credentials and expanded behavioral anomaly detection.\u00a0<\/p>\n

It is commissioning an independent review, raising spending on endpoint and developer-environment security and planning a research fund on AI security with outside firms. Some technical details, the report says, will stay private.\u00a0<\/p>\n

This post Binance Says $6.34 Billion Hack Began With Fake Job Interview\u00a0<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Micah Zimmerman<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Binance Says $6.34 Billion Hack Began With Fake Job Interview\u00a0 The $6.34 billion theft from Binance began with a fake job interview and ran for five months before a single coin moved, the exchange said Tuesday in its first public account of the Oct. 29 attack. Another initial incident report from Binance, released […]<\/p>\n","protected":false},"author":0,"featured_media":247120,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-247119","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/247119"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=247119"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/247119\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/247120"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=247119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=247119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=247119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}