$6.3 Billion Binance Heist Traced to Malware-Laced Coding Test During Fake Recruitment Interview

TLDR

Table of Contents

Hackers deployed malware through a fraudulent job interview process, leading to a $6.3 billion cryptocurrency theft from Binance.
The multi-month operation targeted multiple Binance engineers, with attackers infiltrating internal infrastructure before the October 29 heist.
Federal investigators connected the breach to North Korea’s TraderTraitor hacking collective, a claim Pyongyang has disputed.
Thieves leveraged Ethereum’s EIP-7702 protocol feature to commandeer a Binance hot wallet and execute unauthorized transfers.
Former Binance CEO Changpeng Zhao cautioned that artificial intelligence will likely accelerate cyber threats facing digital asset platforms and financial institutions.

Binance disclosed that cybercriminals leveraged a sophisticated fake recruitment scheme to execute a $6.3 billion heist from the platform on October 29. Exchange leadership revealed during a Tuesday media briefing that the attack culminated after months of persistent infiltration attempts. The theft represents the most significant documented cryptocurrency breach in the industry’s history.

Fraudulent Recruitment Campaign Compromised Platform Engineers

During September, a Binance software engineer engaged with an individual claiming to be a talent recruiter via a legitimate employment platform. Security chief Jimmy Su explained that the interaction included a video call and what appeared to be an authentic social media presence.

A follow-up contact identifying as a company executive later provided the engineer with a technical assessment. When downloaded, the file deployed malware onto the employee’s work device while evading detection by security protocols, Su detailed.

The exchange also identified an earlier compromise dating to June, when a different engineer installed a tampered Homebrew software distribution. Although Binance replaced that particular machine, other members of the wallet team remained vulnerable to the attack.

Stolen Credentials Enabled System Penetration

On October 20, threat actors gained access to two wallet engineers’ workstations by leveraging the compromised device alongside an internal artificial intelligence application. Eight days afterward, they executed malicious code using pilfered authentication credentials.

The cryptocurrency transfers commenced at 20:05 UTC on October 29. Federal law enforcement attributed the operation to North Korea’s TraderTraitor hacking unit. North Korean officials have denied any connection to the incident.

Su explained that the perpetrators took advantage of Ethereum’s EIP-7702 protocol enhancement to seize control of an internet-connected wallet. The exchange required multiple hours to revoke that unauthorized access and halt additional fund movements.

Former CEO Advocates Enhanced AI Security Measures

Changpeng Zhao, who founded Binance, cautioned that artificial intelligence capabilities may enable more frequent attacks targeting both cryptocurrency platforms and traditional banking institutions. “The industry needs to use AI to prevent AI hacks,” he stated to CoinDesk.

Zhao provided no evidence demonstrating that AI technology powered this particular breach. Blockchain analytics firm Elliptic indicated that the movement patterns of stolen funds appeared to follow pre-programmed scripts rather than AI-directed activity. Meanwhile, financial regulators in South Korea recommended that exchanges increase their offline cryptocurrency storage practices.

The former executive also advocated for unified security frameworks and enhanced collaboration throughout the cryptocurrency sector. He confirmed that preliminary discussions have begun, though industry participants have yet to finalize a coordinated approach.

Asset Recovery Progresses While Normal Operations Resume

CEO Richard Teng disclosed that partner organizations have successfully frozen approximately $2.85 billion worth of the stolen digital assets. He stated that Binance has utilized its own reserves to replace roughly 98% of the affected tokens, ensuring customers will experience no financial losses.

The platform initiated a second withdrawal phase on Tuesday as customer redemption activity moderated. Teng documented $10.97 billion in total withdrawals and $5.28 billion in net outflows across a 46-hour period. The exchange has committed to commissioning an independent security audit and confirmed it has successfully blocked 57 suspected North Korean attack attempts throughout the current year.

✨ Limited Time Offer