Binance: $6.3B Hack Began With a Fake Job Interview

The largest crypto theft on record did not start with a broken password or a bug in Binance's code. It started with a job interview. In an incident report and media briefing on Tuesday, 3 November, the exchange said the attackers behind the roughly $6.34 billion hack spent months working their way in, using fake recruiters, a booby-trapped coding test and Binance's own internal AI tooling.

"This wasn't one mistake or one breach. It was a months-long campaign," co-CEO Richard Teng said, as quoted by The Block. TheStak has followed the hack and Binance's recovery since it was discovered.

How the attackers got in

Binance's account, as reported by CoinDesk, The Block and CNBC, runs in four steps:

1. June: a Binance Wallet DevOps engineer, searching for a popular AI coding tool, installed a tampered copy of Homebrew, a common developer installer. Binance's security team caught it, replaced the laptop and rotated his credentials, but says details of his role and his colleagues on the wallet team were already exposed.
2. September: another engineer was approached through a legitimate job platform by someone posing as a project director. A fake HR representative interviewed him by video, and a second interview with a supposed CEO ended with a coding assignment to download onto his work computer. According to CoinDesk, it carried previously unknown malware that slipped past Binance's endpoint security.
3. 20 October: from that infected machine, the attackers used an internal AI tool to take over the computers of two wallet engineers, chief security officer Jimmy Su said. On one of them they found a permission to deploy software containers.
4. 29 October: they used those stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC (21:05 in Lagos), and Binance says containment was complete by 00:10 UTC on 30 October.

CoinDesk reports that the attackers used an Ethereum feature known as EIP-7702 to gain the right to execute transactions from a hot wallet, and that because Binance's hot wallets use multiparty computation, no single key could revoke that permission once it was granted.

Related · AI and Tech StakNigerian Crypto Exchanges Triple Inflows to $6.22bnLocal platforms now take about half of Nigeria's exchange inflows, Chainalysis says, just as the SEC's ₦2 billion capital rule raises the cost of entry.

Where the money stands

Teng told CNBC that Binance has replenished 98% of the affected assets and is still buying the remaining, less liquid tokens. About $2.85 billion has been frozen or intercepted, he said, with partners including Tether and Circle helping to lock stolen funds. Binance has pledged to cover all customer losses and says users will not be affected.

Binance says it has rebuilt the affected wallet system and the internal AI tool, replaced compromised devices, cancelled credentials tied to the engineers involved and widened security scans across staff devices. It will bring in independent cybersecurity experts to review the incident. Withdrawals are being reopened in phases, network by network.

Teng did not name North Korea himself, but noted that the FBI has linked the attack to TraderTraitor, a North Korean state-backed group. North Korea has denied it. Binance also says it detected and stopped 57 suspected North Korea-linked attacks earlier this year, many of them using fake interviews, malicious developer tools and social engineering.