Skip to main content
Uruguay Can

News from across crypto

Binance says fake job interview opened path to $6.3B hack

Binance says a fake hiring process and malware opened a months-long route into its wallet systems before attackers stole $6.3 billion in crypto.

Uruguay Can Editorial

Binance says fake job interview opened path to $6.3B hack

Binance had not explained how attackers reached its wallets until Tuesday, when it said a fake job interview helped open the way to last week’s $6.3 billion theft.

At a media briefing, Binance said the attack was a months-long campaign that compromised employee devices and wallet systems. CoinDesk’s report on the briefing said the exchange linked the campaign to North Korea after the FBI attributed the attack to the country.

What did the fake interview give attackers?

Binance said the interview let attackers place malware on an engineer’s work computer. The exchange’s account, detailed by Reuters, traces the access back further, to a tampered software tool downloaded by another wallet-team engineer in June.

  1. In September, an engineer seeking a job was interviewed by people posing as company staff and asked to download a coding assignment.
  2. Binance said the assignment contained malware that evaded security tools. On Oct. 20, attackers used the compromised computer and an internal AI tool to reach two wallet engineers’ systems.
  3. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script against Binance’s wallet infrastructure.

How did the attackers move the crypto?

Binance said attackers used Ethereum’s EIP-7702 feature to gain execution rights over a hot wallet, which is connected to the internet. Reuters reported that 233.46 million XRP left five Binance hot wallets in four minutes, with other crypto also taken. Binance said the theft reached $6.3 billion.

What has Binance done since the breach?

Binance said it froze or intercepted about $2.85 billion in assets and replenished about 98% of affected tokens with company funds. It also said it had closed the entry points used in the attack and would commission an independent cybersecurity review. The exchange has attributed the attack to North Korea based on the FBI’s assessment; North Korea has denied involvement, Reuters reported.

Sources