Binance traces $6.3B hack to fake job interviews and a compromised AI coding tool
Binance traces $6.3 billion theft to fake job interviews and a tampered AI tool
Binance says hackers stole about $6.3 billion by spending months targeting its employees with fake job interviews, malicious files, and a compromised AI coding tool, before breaking into the exchange's wallet infrastructure. An exchange is a service where people buy and sell cryptocurrency. The findings come from an investigation report the company published on Tuesday, Nov. 3, covering the Oct. 29 theft.
The attack did not exploit Binance's customer-facing systems directly. It worked by gaining access to employee computers and then to the internal service that authorizes the exchange's cryptocurrency transactions, letting the attackers move funds outside the normal withdrawal process.
Key points
- The campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool.
- In September, attackers posing as recruiters tricked a second engineer into downloading a malicious file disguised as a coding assignment.
- On Oct. 20, the attackers used that computer and an internal AI tool to reach two more engineers' systems and obtain deployment credentials.
- On Oct. 29, they installed malicious software in Binance's wallet infrastructure and reached the internal wallet-signing service that authorizes transactions.
- Binance reports $2.85 billion frozen or intercepted and says it replenished 98% of the affected tokens by Oct. 31.
What Binance's investigation found
According to the report, the first compromise happened in June. An engineer downloaded a tampered software package while setting up an AI coding tool. Binance says it detected the malware — software meant to harm or spy on a computer — and replaced the affected device, but the attackers had already collected information about the exchange's wallet team.
In September, attackers posing as recruiters contacted another software engineer and convinced them to download a malicious file presented as a coding assignment. The malware compromised the engineer's work computer and evaded the exchange's security protections.
On Oct. 20, the attackers used that computer and an internal AI tool to gain access to two additional engineers' systems. From there they obtained deployment credentials, which let them install malicious software inside Binance's wallet infrastructure on Oct. 29.
The final step was reaching the internal wallet-signing service, the system that authorizes cryptocurrency transactions for the exchange's own wallets. With access to it, the attackers moved funds without going through the normal withdrawal process.
How transfers continued after withdrawals were suspended
Binance says the attackers also exploited EIP-7702, a mechanism on the Ethereum network that lets a wallet delegate its transaction permissions to a smart contract — a program that runs on the blockchain. Because of that delegation, unauthorized transfers could continue even after the exchange suspended withdrawals.
The report adds that Binance's multiparty computation (MPC) wallet system complicated the response. MPC distributes control over transaction signing across multiple parties, so no single key holder can revoke the permissions on its own.
What Binance says it will do about losses
The breach affected roughly $6.3 billion in digital assets. Binance reports that $2.85 billion had been frozen or intercepted as of its latest accounting. The exchange says it will absorb the remaining losses rather than pass them on to customers, and that it had replenished 98% of the affected token assets by Oct. 31.
Who is blamed, and the denial
The FBI has attributed the attack — reported here as the largest cryptocurrency hack in history — to North Korean hackers. On Tuesday, Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied the country was involved. She said the FBI's attribution was politically motivated and intended to damage North Korea's international standing. The attribution is therefore disputed between the two parties.
What the exchange's co-CEO said
"This wasn't one mistake or one breach — it was a months-long campaign," Binance co-CEO Richard Teng said in a Tuesday post on X.
What is still unclear
The full amount stolen is reported differently as investigations continue: Binance's postmortem describes approximately $6.3 billion, while separate reports circulating the same day cite totals near $6.4 billion. Binance's $2.85 billion frozen-or-intercepted figure is described as its latest accounting, so recovery numbers may keep changing. North Korea's involvement is confirmed only in the FBI's attribution, which North Korea denies.
Sources
- Cointelegraph
- Richard Teng, post on X (quoted by the source)
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.