TLDR Binance revealed that hackers used a fake job interview to install malware before stealing $6.3 billion in cryptocurrency. Attackers spent months targeting Binance employees and gaining
Binance said a fake job interview helped hackers steal $6.3 billion from the exchange on October 29. The Binance hack followed months of attempts to enter its systems, executives said at a media briefing Tuesday. The exchange described the theft as the largest known cryptocurrency hack to date.
In September, a software engineer met a supposed recruiter through a real employment platform. A video interview and personal social media profile appeared genuine, Binance security chief Jimmy Su said.
A later caller posing as a chief executive sent the engineer a coding test. The download installed malware on a work computer without triggering security software, according to Su.
Binance also traced an earlier breach to June, when another engineer installed a modified Homebrew software package. The company replaced that device but said other wallet staff remained exposed.
On October 20, the attackers reached two wallet engineers’ computers using the infected device and an internal AI tool. Nine days later, they deployed malicious code with stolen login details.
The thieves began transferring crypto at 20:05 UTC on October 29. The FBI linked the theft to North Korea’s TraderTraitor group. Pyongyang has rejected the accusation.
Su said the attackers exploited Ethereum’s EIP-7702 feature to control a wallet connected to the internet. Binance needed several hours to remove that access and stop further transfers.
Binance founder Changpeng Zhao warned that artificial intelligence could make attacks on exchanges and banks more common. “The industry needs to use AI to prevent AI hacks,” he told CoinDesk.
Zhao offered no proof that AI drove the breach. Elliptic said stolen-fund movements appeared scripted, not directed by AI agents. Elsewhere, South Korean regulators urged exchanges to increase offline crypto storage.
Zhao also called for shared security standards and closer cooperation across the industry. He said talks had started, but participants had not agreed on a plan.
Teng said partners had frozen about $2.85 billion of stolen assets. Binance had replaced roughly 98% of affected tokens with its own money, he said, and customers would not bear losses.
Binance began a second phase of crypto withdrawals on Tuesday as customer outflows slowed. Teng reported $10.97 billion in withdrawals and $5.28 billion in net outflows over 46 hours. The exchange plans an independent security review and said it blocked 57 suspected North Korea-linked attacks this year.
The post Binance Hack Investigation Reveals How Attackers Bypassed Security appeared first on Blockonomi.
