Binance Links $6.3B Hack to Fake Job Interviews and AI Tool Breach

Binance has published details of how a months-long cyberattack culminated in the theft of $6.3 billion from its systems, including a chain of compromises that began with fake job-related interactions and ended with unauthorized movement of funds outside the usual withdrawal flow.

In a postmortem shared on Tuesday, the exchange said the operation relied on tampered software and social engineering to gain access to members of its wallet and engineering teams—then used internal wallet-signing infrastructure to authorize transactions. Binance also described how Ethereum’s EIP-7702 delegation mechanism played a role in the attackers’ ability to keep transfers possible even after withdrawals were suspended.

Key takeaways

• Binance traces the compromise to a campaign that started in June and escalated through multiple targeted engineer infections before the Oct. 29 theft.
• The attackers moved beyond normal withdrawal pathways by accessing Binance’s internal wallet-signing service, which authorizes cryptocurrency transactions.
• According to Binance, Ethereum’s EIP-7702 mechanism helped sustain unauthorized transfers even after Binance suspended withdrawals, while MPC wallet controls complicated revocation.
• Binance says $2.85 billion was frozen or intercepted, and it reported replenishing 98% of affected token assets as of Oct. 31.
• Binance leadership says the exchange blocked 57 suspected North Korea-linked threats in 2026, including malicious interview schemes and credential-stealing attempts.

A compromise campaign built around employee targeting

Binance’s account describes the attack as more than a single breach. Instead, the exchange outlines a step-by-step intrusion that used both human and technical vulnerabilities to reach the wallet infrastructure.

The timeline begins in June, when a wallet-team engineer downloaded a tampered software package while setting up an AI coding tool. Binance said it detected the malware and replaced the affected device, but the attackers had already collected enough information to understand the wallet team’s environment.

In September, the intruders shifted tactics and targeted another engineer by impersonating recruiters. Binance reported that the engineer was persuaded to download a malicious file disguised as a coding assignment. The malware then compromised the engineer’s work computer and, crucially, evaded Binance’s security controls at the endpoint level.

On Oct. 20, Binance says the attackers used the compromised computer alongside an internal AI tool to reach two additional engineers’ systems. That access provided deployment credentials, which enabled the installation of malicious software inside Binance’s wallet infrastructure on Oct. 29.

Turning wallet signing into unauthorized transfers

The postmortem emphasizes that gaining entry to internal systems was only part of the problem. The attackers ultimately accessed Binance’s internal wallet-signing service, which performs authorization for cryptocurrency transactions. With that capability, Binance said the attackers were able to move funds in a way that did not rely solely on the normal withdrawal process.

Binance co-CEO Richard Teng characterized the incident as systemic rather than accidental. In a Tuesday post on X, Teng said, “This wasn’t one mistake or one breach — it was a months-long campaign.”

https://x.com/_RichardTeng/status/2117626871445921884

Ethereum EIP-7702 and why MPC made reversal harder

Binance also pointed to an Ethereum-specific factor it says attackers exploited. The exchange stated that the intruders leveraged Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts. In practice, that can enable unauthorized transfers to persist even after an exchange suspends withdrawals.

The exchange further said its MPC (multiparty computation) wallet system complicated efforts to revoke the delegation permissions. With MPC distributing transaction signing control across multiple components, emergency countermeasures may require coordinated actions that are harder to execute quickly—especially if delegated capabilities are already in place.

Binance did not present speculative details beyond what it reported in the postmortem, but its description underscores a broader issue for centralized exchanges: even strong internal operational security may not be sufficient if threats can manipulate wallet-permission models on-chain.

Scope of losses, recovery steps, and disputed attribution

Binance said the breach affected approximately $6.3 billion in digital assets. The exchange reported that $2.85 billion had been frozen or intercepted, according to its latest accounting, and said it would absorb the losses rather than pass them on to customers. Binance also reported replenishing 98% of affected token assets as of Oct. 31.

Earlier coverage by Cointelegraph framed the incident as the largest cryptocurrency hack in history, citing Binance’s reported figures. For reference, see: https://cointelegraph.com/news/recap-binances-record-63b-hack-unfolded.

On attribution, Binance’s postmortem is complemented by public statements from authorities. The FBI has attributed the attack to North Korean hackers, while Kim Yo Jong—the sister of North Korean leader Kim Jong Un—denied North Korea’s involvement on Tuesday. Cointelegraph reported on her remarks, which said the FBI’s attribution was politically motivated and intended to harm North Korea’s standing. See: https://cointelegraph.com/news/north-korea-denies-role-in-63b-binance-hack-points-finger-at-us.

Threat blocking—57 thwarted attempts—yet one campaign still succeeded

Binance leadership also used the disclosure to highlight how frequently it says it blocks advanced threats. Co-founder Yi He stated that Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages, and social engineering attempts aimed at stealing credentials or installing malware.

“We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened,” He said in a Tuesday post on X.

https://x.com/heyibinance/status/2117641073095033095

That contrast—dozens of thwarted attempts versus a single campaign that ultimately reached wallet signing—offers a critical lesson for the sector. It suggests that defensive maturity alone is not enough when attackers can combine social engineering, endpoint compromise, and internal access to cross from “attempted intrusion” into transaction authorization.

Going forward, exchanges and wallet integrators will likely focus on how to prevent delegated permissions from becoming a lingering authorization channel after withdrawals are halted, while also tightening internal processes that can be exploited through employee-targeted lures like “coding assignments.” Readers should watch for how Binance and other operators translate this incident into concrete changes to endpoint security, credential use, and permission revocation mechanics on-chain.