Fake Job Interview Led to Binance’s $6.3 Billion Hack, Exchange Says

At a media briefing on Tuesday, Binance said the record theft grew out of a months-long campaign by North Korea-linked attackers, a claim the FBI has backed. CEO Richard Teng described it as an operation built slowly over many months. Chief security officer Jimmy Su explained that in September a software engineer was approached through a real job platform by someone posing as a project director. A fake HR contact held a video interview, and a second meeting with a supposed CEO ended with a coding assignment that the engineer was told to download onto his work computer. It hid zero-day malware that slipped past endpoint security.

How the Attackers Reached the Wallet Team

An earlier slip came in June, when a different engineer installed a tampered Homebrew package while hunting for an AI tool. Binance replaced that device, but the wallet team stayed exposed. On Oct. 20, the attackers used the infected machine and an internal AI tool to reach two wallet engineers’ computers. By Oct. 29 they had stolen credentials, launched a container and run a malicious script, and funds began leaving at 20:05 UTC.

EIP-7702 Hot Wallet Exploit Explained

Su said the hackers used Ethereum’s EIP-7702 feature to gain execution rights over a hot wallet. Since Binance’s hot wallets rely on multiparty computation, no single key could cancel that access, so containment only came at 00:10 UTC on Oct. 30.

Recovery Numbers and Next Steps

Teng said about $2.85 billion has been frozen and roughly 98% of affected tokens have been replaced with company money, adding that users will not be affected. Binance blocked 57 suspected North Korea-linked attempts this year and plans to bring in independent experts to review the incident.