Skip to main content
Uruguay Can

News from across crypto

Binance says $6.3B hack began with fake hiring pitch

Binance says a months-long campaign used a fake hiring pitch and wallet-signing access to steal $6.34B, while recovery and withdrawal reopening continue.

Uruguay Can Editorial

Binance says $6.3B hack began with fake hiring pitch

Binance says a months-long operation culminated in a $6.34 billion theft from its hot wallets on Oct. 29, in what CoinDesk described as crypto’s biggest heist. Before the attack, those wallets processed withdrawals through Binance’s usual signing systems; the breach let attackers authorize transfers outside that process, the exchange said in its initial findings report.

How did the attackers get inside Binance?

Binance says a fake job interview helped attackers compromise an employee’s work computer. In September, an engineer was contacted on a job-hunting platform by someone posing as a project director. After two interviews, the engineer was asked to download a coding assignment that contained malware. Binance says the attackers later used the compromised machine and an internal AI tool to reach other employees’ devices and obtain credentials.

On Oct. 29, they used those credentials to deploy a container and run a malicious script. Binance’s report says the attackers exploited Ethereum’s EIP-7702 authorization mechanism to give a malicious smart contract execution rights over a hot wallet. EIP-7702 can delegate some account actions to a contract without revealing the private key, so this attack did not require a confirmed private-key leak. Binance says the FBI attributes the incident to North Korea; CoinDesk’s report on the briefing also identifies the attackers as North Korea-linked.

What was taken, and what has Binance recovered?

Binance says five hot wallets transferred 233.46 million XRP between 20:05 and 20:09 UTC, alongside assets from its Solana and Optimism wallets. It later reported that about $2.85 billion had been frozen or intercepted, while 98% of affected tokens had been replenished with company funds as of Oct. 31. The exchange says users will not bear the loss.

Are withdrawals available again?

Binance has been reopening withdrawals in stages after suspending them during containment. Its Nov. 5 update scheduled more assets to resume from 04:00 UTC, with availability rolling out as security checks finish. The response has involved three linked steps:

  1. Suspend withdrawals to limit further outflows.
  2. Coordinate with partners to freeze affected assets.
  3. Revoke the unauthorized on-chain permissions.

Binance says the existing permissions could keep moving assets even after withdrawals were suspended, and the wallet’s multi-party signing setup meant there was no single key to revoke them immediately.

Sources