Binance Hack Began with a Fake Job Interview, Report Says

Binance has published its first incident report on the Oct. 29 theft. The exchange says about $6.34 billion in digital assets was affected, and that attackers worked their way in over several months through fake job interviews and a compromised internal AI tool.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance wrote on X.

How the attack ran on Oct. 29

Binance says the attacker used unauthorized access to an internal wallet signing service to start transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism then sent about 970,500 SOL and 44.2 million OP.

Binance received an internal alert about large transfers and began investigating. By then, a hot wallet had sent 18,270 BTC to an attacker-controlled address.

About $2.85 billion has been frozen or intercepted, "subject to reconciliation and market price volatility," Binance said. Earlier updates from the exchange put the frozen total at around $3 billion, so the figure has come down.

Why the outflows kept going after withdrawals stopped

Suspending withdrawals did not end the theft. The attacker used the signing service to exploit Ethereum's EIP-7702 mechanism and gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

"The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance's normal withdrawal infrastructure," the report said.

EIP-7702 went live with Ethereum's Pectra upgrade in May 2025. It lets a standard account delegate execution to a smart contract, which makes it useful for wallet features and, as this case shows, for abuse.

The attackers submitted 50 signing transactions to manipulate the account nonce and set up the delegations. Revoking them was harder than usual because the hot wallet used multi-party computation (MPC). Binance said "there was no single private key that could be used to immediately revoke" the authorizations, so the team built a specialized procedure.

The last unauthorized transfer, 2,961.9 ETH, finalised on-chain at 23:56 UTC. At 00:10 UTC on Oct. 30, Binance sent a new authorization from its Binance14 hot wallet to the zero address, which cleared the delegation code. No further transfers were seen after that.

A campaign that began in June

Binance describes a multi-stage operation, not a single phishing event. The first step came in June 2026, when a wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool. Security staff spotted the anomaly, replaced the device and rotated credentials. Binance says the engineer's role, and his colleagues on the wallet team, had by then been exposed to the attacker.

In September, a second engineer was approached on a legitimate job platform by someone posing as a Project Director. Two interviews followed. In the second, held on a chat app, he was told to download an "assignment" that contained a malicious code repository. Binance says the malware was a zero-day that endpoint tools did not catch, and that it swapped a legitimate development tool component for a malicious one.

Fake recruitment is a known North Korean tactic. Security researchers track a campaign they call Contagious Interview, in which developers are lured with job offers and asked to run code. The February 2025 Bybit theft, which the FBI tied to TraderTraitor five days later, also began with a compromised developer machine at Safe{Wallet}.

On Oct. 20, the attacker used the first engineer's compromised computer and an internal AI tool to take control of the wallet DevOps engineer and a second wallet engineer. The attacker found a container deployment permission token on the DevOps engineer's machine. Between 17:15 and 19:56 UTC on Oct. 29, the attacker logged onto the second engineer's computer, used the stolen credentials, deployed a container and ran the script that launched the theft.

Binance says its security team blocked 57 suspected North Korea-linked cases during 2026. The FBI has named North Korea as responsible. North Korea has denied involvement, according to coverage of the report.

Repairs, reserves and reaction

Binance says 98% of the impacted token assets had been replenished as of Oct. 31 and can be checked on its Proof of Reserves page. It is buying the remaining, more illiquid assets and says it has set aside more than 100% of the funds needed.

The exchange says it closed the entry points and rebuilt the affected wallet system and the internal AI tool. It also replaced devices, decommissioned related credentials and scanned all employee devices. Independent security firms will review the findings, and Binance plans a security research fund. Some technical details will stay private.

Binance founder Changpeng Zhao, now a shareholder, said:

"A hack of this scale means serious security failures occurred. No platform is unhackable, but that cannot be an excuse." He added that public explanations "simplify what appears to have been a prolonged multi month/year attack targeting hundreds of employees and systems."

Mercado Bitcoin Hack: Wallets Drained Across 10 Chains | HODL FM NEWS

Mercado Bitcoin suspended deposits and withdrawals after wallets were drained across 10 blockchains. Here is what is known about the $38M loss and the freezes.

HODL FM News: The Wildest Ride in the Crypto MarketRoman Zaika

Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.