Image credit: Shutterstock
- Binance revealed fake interviews and compromised AI tools enabled a $6.34 billion attack.
- Stolen credentials allowed unauthorized transfers by reaching wallet-signing operations through compromised engineer devices.
- The Binance investigation remains open and will undergo an independent review.
On Nov. 3, Binance revealed that the fake recruitment interviews and compromised internal AI tooling enabled the Oct. 29 attack involving approximately $6.34 billion in digital assets. The exchange pledged to absorb the financial impact, meaning customers would not bear the stolen-fund losses.
Its initial findings describe several compromised systems rather than a single laptop failure. Binance cleared that the investigation remains open and will undergo independent review.
Fake Recruiters Turned a Coding Test Into Malware
A Binance engineer was approached through a legitimate recruitment platform in September and completed interviews with people posing as company representatives. A coding assignment then installed malware on the engineer’s work computer.
Similar fake-interview schemes have targeted individual crypto holders, organizations, and protocols. Its researchers attributed more than $14.3 million in losses over the preceding 18 months to related North Korea-linked schemes, indicating that the threat extends beyond large exchanges.
Internal Access Reached Wallet Signing Systems
Binance stated that the attackers used the compromised computer and an internal AI tool on Oct. 20 to reach two wallet engineers’ devices. Stolen credentials subsequently enabled access to wallet-signing operations, allowing unauthorized transfers outside the normal customer withdrawal process.
On Ethereum, attackers used EIP-7702, an account-delegation mechanism, to grant a malicious smart contract partial control over a Binance hot wallet. Those permissions operated independently of Binance’s withdrawal infrastructure.
Pausing customer withdrawals therefore did not automatically stop the unauthorized transfers. Binance needed additional transactions to revoke the malicious authorizations.
Replacement Funds Differ From Recovered Assets
Binance stated that the 98% of affected token assets had been replenished by Oct. 31 and that purchases of the remaining, less-liquid assets were continuing. Replacement purchases restore assets backing customer balances, rather than retrieve the stolen cryptocurrency.
Binance had set aside more than enough funds to cover the loss and would absorb the financial impact. It separately reported approximately $2.85 billion frozen or intercepted, subject to reconciliation and market-price changes; those assets have not necessarily been returned.
Binance has rebuilt the affected wallet environment and internal AI tool, replaced compromised devices and retired related credentials. Independent security specialists will review the findings and recommend further changes.
