Binance says fake job interview preceded $6.34 billion hack
Binance says a fake September job interview helped attackers reach wallet systems before $6.34 billion in assets were impacted during the Oct. 29 theft.
By Web3 Hub Newsroom2 min read
Binance said Nov. 3 that a fake recruitment process helped attackers compromise its systems before $6.34 billion in digital assets were affected in an Oct. 29 breach, exposing a months-long route into its wallet infrastructure, according to the exchange’s initial findings and response update.
What did the fake interviewer ask the engineer to do?
In September, an attacker posing as a project director contacted a Binance software engineer through a legitimate job-hunting platform, Binance said. After video and chat-app interviews with people posing as company staff, the engineer was told to download a coding assignment to his work computer.
Binance said the assignment contained a malicious code repository that ran during setup. Its malware evaded endpoint security tools and allowed the attacker to communicate with an external server.
How did the job scam reach Binance’s wallets?
The fake interview was one stage of the campaign. Binance said an earlier, separate compromise began in June, when a wallet team engineer downloaded a tampered software package; the company replaced the device and rotated credentials but said the employee’s role and colleagues on the wallet team had been exposed.
On Oct. 20, the attacker used the compromised interviewee’s computer and an internal AI tool to reach two wallet engineers’ devices, Binance said. On Oct. 29, the attacker used stolen credentials to deploy a container and run a script that accessed wallet signing operations. The Reuters report said the breach moved 233.46 million XRP from five hot wallets in four minutes.
How much was frozen, and what comes next?
Binance reported about $6.34 billion in impacted assets and said about $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes. The exchange said it would absorb the financial impact and had replenished 98% of affected tokens as of Oct. 31.
The FBI attributed the theft to North Korea, Reuters reported; North Korea rejected the accusation. Binance says the investigation is ongoing and that independent cybersecurity experts will review its findings, with no review date announced.
References
- initial findings and response update — binance.com
- Reuters report — investing.com