Fake job interview preceded Binance’s $6.34bn hack
Binance says a fake job interview helped attackers compromise its wallets; 98% of $6.34 billion in affected assets is replenished as an outside review begins.
The Blockheight Editors··2 min read
Binance said on Nov. 3 that attackers used a fake job interview and other methods in a campaign that led to $6.34 billion in affected digital assets on Oct. 29, according to the exchange’s initial incident report. The breach began with employee compromises months earlier; Binance said it will cover the financial impact, not users.
How did a fake interview compromise a Binance engineer?
In September, an engineer was contacted on a job platform by someone posing as a project director, Binance said. After video interviews with people claiming to be the HR representative and CEO of a fictitious company, the engineer downloaded a coding assignment containing malware that evaded endpoint security tools.
Binance said the campaign had an earlier foothold: in June, another employee downloaded a tampered Homebrew installation while seeking an AI coding tool. The exchange detected the issue, replaced the device and rotated credentials, but said the employee’s role and colleagues on the wallet team had been exposed.
How did the attackers reach the wallets?
On Oct. 20, attackers used the compromised engineer’s computer and an internal AI tool to reach two wallet engineers’ machines, Binance said. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script against the wallet-signing system.
Transfers began at 20:05 UTC, with five hot wallets sending 233.46 million XRP in four minutes, according to Reuters’ report on Binance’s findings. Binance said the attackers also exploited Ethereum’s EIP-7702 authorization mechanism to move assets outside the normal withdrawal process.
What has Binance done, and what remains under review?
Binance said about $2.85 billion had been frozen or intercepted and 98% of affected token assets had been replenished as of Oct. 31. It said the FBI attributed the incident to North Korea; Reuters reported that North Korea rejected the accusation.
Binance has engaged independent cybersecurity experts to review its findings, and its investigation remains ongoing. The exchange has not published the review’s conclusions.
Source material
- initial incident report — binance.com
- Reuters’ report on Binance’s findings — live.euronext.com