coindesk.com
Binance’s $6.3 billion hack began with a fake job interview, the exchange said Tuesday in a media briefing, describing a months-long campaign by North Korea-linked attackers to infiltrate the exchange and carry out the biggest heist in crypto history.
Binance’s Richard Teng told reporters the attack “was a campaign, built over many months” and said the FBI has attributed it to North Korea.
Jimmy Su, Binance’s chief security officer, said a software engineer was contacted in September through a legitimate job platform by someone posing as a project director. A fake HR representative interviewed him by video and shared a social media account with personal photos to build trust. A second interview, with a purported CEO, ended with the engineer being told to download a coding assignment onto his work computer. It contained zero-day malware that evaded endpoint security.
In June, another engineer had installed a tampered Homebrew package while searching for an AI tool. Binance caught and replaced the device, but said the engineer and his colleagues on the company’s wallet team remained exposed.
On Oct. 20, attackers used the machine compromised by the fake interview and an internal AI tool to reach two wallet engineers’ computers, Su said. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC.
The attacker used an Ethereum feature called EIP-7702 to gain execution rights over a hot wallet, Su said. Because Binance’s hot wallets use multiparty computation, no single key could revoke it, and containment took until 00:10 UTC on Oct. 30.
Teng said about $2.85 billion has been frozen and about 98% of affected tokens have been replenished with company funds. He said users won’t be affected. Binance said it blocked 57 suspected North Korea-linked attempts this year and will bring in independent experts to review the incident.
