Binance says $6.34bn hack began with a fake job interview

Binance says attackers used a fake job interview to compromise an engineer’s work computer before a security breach affected $6.34 billion in digital assets on October 29. The exchange’s November 3 report describes a campaign that began months earlier and involved several employees and systems.

Crypto exchanges rely on internal signing systems to authorise transactions from wallets connected to the internet.

The account shows how a recruitment scam and access to internal tools can put wallet operations at risk, even when an attack unfolds across several stages.

How did the fake interview give attackers access?

In September, a software engineer whose profile mentioned Binance was contacted through a legitimate job-hunting platform by someone posing as a project director, according to Binance’s incident report. The engineer met a supposed HR representative by video, then a person claiming to be the CEO of a fictitious company through a chat app.

The engineer was asked to download a coding assignment to a work computer. Binance says the code repository contained malware that ran during setup, replaced part of a development tool and communicated with an attacker-controlled server. The company says its device security tools did not detect the malware at the time.

How did the breach reach Binance’s wallets?

The interview was one stage in a longer operation. Binance says an earlier compromise began in June, when a wallet developer downloaded a tampered Homebrew installer; in October, attackers used the compromised engineer’s computer and an internal AI tool to gain control of two other engineers’ systems.

On October 29, the attackers used stolen credentials and a container deployment token to run a script that reached the wallet signing service. Binance says five hot wallets sent 233.46 million XRP in four minutes, followed by transfers of other assets. The last unauthorised transfer confirmed on-chain was at 23:56 UTC, almost four hours after the first theft.

What has Binance done to cover the loss?

Binance says it will absorb the losses and had replenished 98% of affected token assets by October 31. As of November 3, it said about $2.85 billion had been frozen or intercepted, subject to reconciliation and market price changes.

The exchange says it rebuilt affected wallet systems and its internal AI tool, replaced devices, revoked credentials and strengthened wallet risk controls. It is also commissioning an independent cybersecurity review. Reuters’ report says Binance is increasing investment in AI-enabled detection and plans a security research fund; the investigation is still ongoing.

Sources

• Binance’s incident report — binance.com
• Reuters’ report — investing.com