Fake Job Interview Led to $6.34 Billion Hack, Binance Says

In September, a second engineer was approached through a legitimate recruitment platform by someone posing as a project director. After a video interview with a purported human resources representative, the engineer was asked to download an assignment repository onto a work computer. Malicious code replaced the legitimate pyenv development tool with a compromised version. Binance described the malware as previously undetected by its endpoint security tools and said it concealed activity and removed traces.

On October 20, the attacker used the compromised computer and an internal AI tool to gain control of two wallet engineers' computers, one of which held a container deployment token. On October 29, the attacker used those credentials to deploy a container and run a malicious script that reached wallet signing operations.

Transfers and Permissions

Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address, according to the report. Other wallets sent approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.

The attacker then used the signing service to establish malicious permissions through Ethereum's EIP-7702 mechanism, which allows a wallet to delegate execution to smart contract code. Earlier findings described the attacker using that feature to give a malicious smart contract permission to move funds from a Binance hot wallet known as Binance 14. Binance said suspending withdrawals could not invalidate permissions already established on Ethereum, and that its multiparty computation wallet required a specialized process to address them.

Open Questions

Several points remain unconfirmed, including how much of the $6.34 billion has been recovered beyond the replenishment figures Binance has given, the full set of chains involved, and the complete duration of the intrusion. The attribution to North Korea-linked actors comes from Binance's account as reported by CoinDesk and has not been independently verified in the material available here. Readers should treat the dollar figure as the exchange's stated number pending further disclosure.

Why It Matters

For Traders

Watch for official withdrawal status and asset-specific statements from Binance, since hot-wallet exploits can produce short-term pressure on affected tokens.

For Investors

A loss of this scale through a months-long insider-targeted intrusion raises sustained questions about custody controls and counterparty risk at major centralized exchanges.

For Builders

EIP-7702 delegations can outlive a freeze, so wallet and signing services should audit delegation paths and limit what a compromised signer can authorize.