Binance $6.3B Hack Traced to Fake Job Interview and AI Tool

Binance has attributed a $6.3 billion theft to a months-long cyberattack that combined fake recruiter interviews, malicious coding assignments and compromised employee devices. According to the exchange’s security postmortem, the operation began in June and escalated in September, when attackers impersonated recruiters and persuaded a software engineer to download a file disguised as a coding test.

The malicious file gave attackers control of the engineer’s work computer and allowed them to evade Binance’s security protections. On Oct. 20, the attackers used that compromised system and an internal AI tool to access two additional engineers’ machines, stealing deployment credentials. They then installed malicious software within Binance’s wallet infrastructure on Oct. 29 and reached its internal wallet-signing service, which authorizes cryptocurrency transactions and enabled transfers outside the exchange’s normal withdrawal process.

Binance also said the attackers exploited Ethereum’s EIP-7702 delegation mechanism to authorize transfers through smart contracts, allowing some activity to continue after the exchange suspended withdrawals. The theft complicated Binance’s response because its multiparty computation wallet system distributes transaction-signing authority, making it harder to revoke permissions already granted to attackers.

Approximately $6.3 billion in digital assets were affected, with Binance reporting that $2.85 billion had been frozen or intercepted. Binance co-CEO Richard Teng described the incident as “not one mistake or one breach,” but a coordinated campaign that exploited both employee vulnerabilities and internal security systems.