Skip to the article
Web3 Hub

Markets, protocols and policy, reported

Binance says fake job interview preceded $6.34 billion hack

Binance says a fake September job interview helped attackers compromise staff systems before a $6.34 billion theft, with independent security reviews now planned.

By Web3 Hub Newsroom2 min read

Binance says fake job interview preceded $6.34 billion hack

Binance said on Nov. 3 that a fake job interview helped attackers breach employee systems before they stole about $6.34 billion in crypto on Oct. 29. In its preliminary incident report, the exchange said the attackers used several techniques over months, including malicious software and compromised internal tools.

How did the fake interview give attackers access?

In September, a Binance software engineer was contacted on a legitimate job platform by someone posing as a project director, according to Binance. After two interviews, the engineer was told to download a coding assignment to a work computer; the repository contained malware that Binance said evaded endpoint security tools.

Binance also said an earlier incident in June exposed the roles of wallet team members after an engineer downloaded a tampered software package. On Oct. 20, attackers used the compromised computer and an internal AI tool to reach two wallet engineers’ systems, the exchange said.

How did the attackers move the crypto?

On Oct. 29, attackers used stolen credentials to deploy a container and run a malicious script, Binance said. The Reuters report on Binance’s account said the first transfers included 233.46 million XRP from five hot wallets in four minutes.

Binance said the attackers exploited an internal wallet-signing service and Ethereum’s EIP-7702 authorization mechanism to move funds outside the exchange’s normal withdrawal process. The FBI attributed the theft to North Korea, Reuters reported; North Korea has rejected the accusation.

What happens to the affected funds now?

Binance said it had frozen or intercepted about $2.85 billion and replenished 98% of affected assets by Nov. 3. It said users would not bear the loss and that it was engaging independent cybersecurity firms to review the incident.

The investigation and independent review are continuing, Binance said, with further findings to be shared as they become available.

References