Binance says its $6.3 billion hack began with a fake job interview sent to one of its software engineers. Attackers linked to North Korea then spent months moving through employee devices before reaching the exchange's wallet infrastructure. Binance says it has replenished about 98% of affected tokens with company funds.
Binance traced its $6.3 billion hack to a fake job interview, the exchange said Tuesday in a media briefing. It described a months-long campaign by North Korea-linked attackers.
Richard Teng told reporters the FBI has attributed the attack to North Korea. According to Teng, the attack "was a campaign, built over many months".
How a job offer became a breach
Chief security officer Jimmy Su said a software engineer was contacted in September through a legitimate job platform by someone posing as a project director. A second interview, with a purported CEO, ended with the engineer downloading a coding assignment onto his work computer. It contained zero-day malware that evaded endpoint security.
Next, on Oct. 20, the attackers used the compromised machine and an internal AI tool to reach two wallet engineers, according to The Defiant's account of Binance's incident report. The report does not name the AI tool, The Defiant said.
On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC.
Why containment took hours
The attacker used Ethereum's EIP-7702 to gain execution rights over a hot wallet, Su said. Because Binance's hot wallets use multiparty computation, no single key could revoke it, and containment took until 00:10 UTC on Oct. 30.
Halting withdrawals did not stop the theft. Binance said malicious onchain permissions kept operating outside its normal withdrawal infrastructure and needed separate transactions to revoke.
Recovery and review
Teng said about $2.85 billion has been frozen and about 98% of affected tokens have been replenished with company funds. He said users won't be affected.
Binance said it blocked 57 suspected North Korea-linked attempts this year and will bring in independent experts to review the incident.
Sources: CoinDesk, The Defiant
Trading involves risk.
Risk Disclaimer
