Follow us on Google News
Hackers used fake job interviews, malicious developer software and a compromised internal artificial intelligence tool to infiltrate cryptocurrency exchange Binance before stealing approximately $6.34 billion in digital assets, the company disclosed on November 3.
The findings provide the clearest account yet of how the October 29 attack unfolded. According to Binance’s initial investigation, the operation began in June and involved the compromise of several software engineers’ computers before attackers gained access to systems controlling the exchange’s cryptocurrency wallets.
The US Federal Bureau of Investigation has attributed the theft to a North Korean hacking group, an allegation rejected by North Korea. Binance has promised to absorb the financial losses rather than pass them on to customers.
Fake Recruitment Process Helped Hackers Target Engineers
The attack began in June when an engineer working on Binance’s wallet infrastructure downloaded a tampered version of Homebrew, a software installation tool, while attempting to install an AI coding application.
Binance detected the suspicious activity, replaced the affected computer and changed the associated credentials. However, the attackers had already obtained information about the employee’s responsibilities and colleagues involved in managing the exchange’s cryptocurrency wallets.
A second stage followed in September, when another software engineer was contacted through a legitimate recruitment platform by someone pretending to be a project director.
The employee attended an initial video interview with a supposed human resources representative. The interviewer shared a social media profile containing photographs and videos, apparently to make the recruitment process appear credible.
A second interview was conducted through a messaging application with an individual claiming to be the chief executive of a company that did not exist.
Towards the end of the conversation, the engineer was asked to download a coding assignment onto a work computer. The downloaded files contained malicious software that executed during setup and allowed unauthorised activity.
The malware replaced part of a legitimate development tool, communicated with an attacker-controlled server and attempted to conceal evidence of the intrusion. Binance said its endpoint security systems did not detect the malware at the time.
Internal AI Tool Became Part Of The Attack
On October 20, the attackers used the compromised engineer’s computer and an internal AI tool to gain control of devices belonging to two other employees involved in wallet operations.
During this stage, the attackers discovered credentials that allowed software containers to be deployed within the company’s systems. Such containers are used to run applications and services, making deployment permissions particularly sensitive when they provide access to financial infrastructure.
On October 29, the attackers used a compromised engineer’s computer and previously stolen credentials to deploy a malicious script targeting Binance’s wallet-signing infrastructure.
A wallet-signing service authorises cryptocurrency transactions. Gaining control over it can allow attackers to move digital assets without following the platform’s normal customer withdrawal process.
Between 20:05 and 20:09 UTC, five internet-connected Binance wallets transferred 233.46 million XRP tokens to an attacker-controlled address. Other unauthorised transfers involved Solana, Optimism, Bitcoin and Ethereum assets.
The attackers also exploited Ethereum’s EIP-7702 transaction-authorisation mechanism to grant a malicious smart contract certain powers over a Binance wallet.
In simple terms, this allowed the attackers to create permissions that continued operating on the blockchain even after Binance suspended ordinary withdrawals.
Why Stopping The Theft Took Nearly Four Hours
Binance detected unusually large transfers and began emergency containment measures, including suspending withdrawals, freezing affected assets and attempting to revoke unauthorised permissions.
However, shutting down the exchange’s withdrawal services did not automatically cancel permissions that had already been established on the blockchain.
The company’s wallet infrastructure also used a security system in which control is distributed rather than held through one private key. Binance therefore had to develop additional procedures to remove the malicious authorisations.
The final unauthorised transfer was recorded at 23:56 UTC, nearly four hours after the initial movements. Binance said the malicious permissions were cleared shortly after midnight on October 30.
As of its November 3 report, Binance said approximately $2.85 billion in affected digital assets had been frozen or intercepted. Separately, it reported that 98% of impacted token assets had been replenished using company resources as of October 31.
These figures represent different measures. Freezing stolen assets prevents their movement, while replenishment involves using the company’s own funds to restore coverage of affected holdings.
Binance said it had rebuilt compromised wallet systems, replaced affected devices, disabled exposed credentials and strengthened monitoring of suspicious behaviour.
The company also plans an independent cybersecurity review, greater investment in AI-enabled threat detection and a security research fund developed with industry partners.
The investigation remains ongoing, and the company’s findings have not yet completed independent review.
What This Means For You:
Fake recruitment offers can become an entry point for serious cyberattacks, particularly when applicants are asked to download coding assignments or unfamiliar software. Employees should verify recruiters independently and avoid running untrusted files on work devices.
