A fake job interview was the first step in Binance's $6.3 billion hack

Binance has published its first account of how roughly $6.3 billion in assets left its systems, and the entry point was not a broken smart contract. It was a job interview.

According to the report released on 3 November, a Binance software engineer was looking for a new role in September. Someone posing as a project director contacted the engineer through a legitimate recruiting platform, ran an online interview with a fake HR representative, and shared social accounts with personal photos to build trust. A person claiming to be the CEO then joined on a video call and asked the engineer to download a coding exercise onto a work machine. The file carried previously unseen malware — a zero day — built to get past endpoint security.

It had been tried before

The September interview was not the first attempt. In June, another Binance engineer installed a modified Homebrew package while looking for an AI tool. Attackers had distributed a tampered version of the package with malicious code, and it compromised the engineer's device. Binance says it detected the incident and replaced the machine, but engineers on the wallet team remained exposed.

On 20 October, the attacker used the machine compromised through the fake interview, plus an internal AI tool, to reach the computers of two engineers who worked on wallets. On 29 October, using stolen credentials, the attacker set up a software environment and executed code. Funds began leaving the system at 20:05 UTC.

EIP-7702 and the hot wallet

The attacker exploited EIP-7702, an Ethereum feature, to grant unauthorised transaction execution rights over Binance's hot wallets. Because the hot-wallet system uses multi-party computation, no single private key could revoke that permission on its own. Incident control ran from late on 29 October until 00:10 UTC on 30 October.

Binance says it froze about $2.85 billion of related assets and recovered roughly 98% of the affected tokens. It states that users suffered no financial loss.

Attribution, and the denial

Reuters reports that the FBI attributed the attack to TraderTraitor, a group linked to North Korea, and published associated wallet addresses while asking exchanges and blockchain services to block them. AP reports that Kim Yo Jong, sister of North Korea's leader, rejected the accusation, calling it a political provocation and saying Washington was trying to tie Pyongyang to cybercrime worldwide.

Binance says it blocked 57 suspected North Korea-linked attack attempts this year. It plans to bring in independent security experts to review the incident, increase investment in AI-based threat detection, fund cybersecurity research and work with major AI companies.

What the case actually shows

Two things are worth taking from the report. The first is that the weakest link was a person doing something normal: applying for a job, installing a developer tool. The attack did not need a flaw in the exchange's code; it needed an employee to trust a process that looked routine.

The second is that wallet architecture bought time but not immunity. Multi-party computation stopped any single key from reversing the attacker's permission, and that same property limited how fast Binance could respond. Freezing $2.85 billion and recovering most of the tokens is a strong outcome; it is also a reminder that the recovery window, not the theft, is the number to design for.

Source: Binance incident report published 3 November 2026, with reporting by Reuters and AP as carried by VnExpress.

Author

Ai-Banking-NetworkSecurity (ABN), ABN ASIA was founded by people with deep roots in academia, with work experience in the US, Holland, Hungary, Japan, South Korea, Singapore, and Vietnam. ABN Asia is where academia and technology meet opportunity. With our cutting-edge solutions and competent software development services, we're helping businesses level up and take on the global scene. Our commitment: Faster. Better. More reliable. In most cases: Cheaper as well.

Feel free to reach out to us whenever you require IT services, digital consulting, off-the-shelf software solutions, or if you'd like to send us requests for proposals (RFPs). You can contact us at [email protected]. We're ready to assist you with all your technology needs.