Updated Nov 3, 2026, 11:32 a.m. EST Published Nov 3, 2026, 9:53 a.m. EST
2 min read
Summary
- Attackers used fake recruitment interviews, malicious developer software and compromised employee devices to gain access to Binance’s internal wallet infrastructure.
- The attackers exploited EIP-7702 to establish malicious execution permissions over a Binance hot wallet, allowing unauthorized transfers outside the exchange’s normal withdrawal process.
- The exchange has replenished approximately 98% of the affected tokens using company funds and says that $2.85 billion in assets have been frozen. It is bringing in independent cybersecurity experts to review the incident.
The massive $6.3 billion breach suffered by Binance started via a fraudulent employment interview, the trading platform revealed on Tuesday during a press conference, outlining an extended operation executed by hackers connected to North Korea to penetrate the platform and pull off the largest theft in digital asset history.
Richard Teng of Binance informed journalists that the intrusion “was a campaign, built over many months” and noted that the Federal Bureau of Investigation has linked the activity to North Korea.
Jimmy Su, chief security officer at Binance, explained that a software developer was approached in September via a legitimate employment network by an individual pretending to be a project director. A fake human resources agent conducted a video interview with the victim and shared a social media profile containing personal images to establish credibility. A subsequent interview with a supposed chief executive concluded with instructions for the engineer to install a programming test onto their professional workstation. The file included zero-day malicious software that bypassed endpoint protection.
Back in June, a different developer downloaded a modified Homebrew software library while looking for artificial intelligence software. Binance detected and swapped out that hardware, though the platform noted that the worker alongside teammates within the platform’s wallet division remained vulnerable.
On October 20, the threat actors leveraged the system infected through the fraudulent interview alongside an internal artificial intelligence program to access the machines of two wallet developers, according to Su. By October 29, the perpetrators utilized pilfered authentication details to launch a container and execute a harmful program. Assets started exiting the system at 20:05 UTC.
The hacker leveraged an Ethereum feature named EIP-7702 to secure operational control over a liquid wallet, Su stated. Because the hot wallets operated by Binance rely on multiparty computation, no individual private key could remove the permission, and mitigation efforts lasted until 00:10 UTC on October 30.
Teng mentioned that roughly $2.85 billion has been locked down and that about 98% of the impacted digital assets have been restored using corporate reserves, emphasizing that customers will experience no losses. Binance reported that it intercepted 57 suspected North Korea-associated incursions throughout the year and will engage external cybersecurity specialists to audit the event.
Read all of CoinDesk’s coverage of the Binance hack here.
Originally published at https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says.
