SKN | Binance’s $6.3 Billion Hack Started With a Fake Job Interview, Exposing Deeper Exchange Security Risks

Key Points:

• North Korea-linked attackers reportedly spent months infiltrating Binance, using fraudulent recruitment interviews, malicious software and compromised employee devices.
• The attackers exploited Ethereum’s EIP-7702 mechanism to obtain execution permissions over a Binance hot wallet, bypassing the exchange’s ordinary withdrawal process.
• Binance says approximately $2.85 billion in assets have been frozen and 98% of the affected tokens replenished with company funds, while independent cybersecurity experts are being brought in to review the incident.

Binance has disclosed that its reported $6.3 billion security breach began with a fraudulent job interview, revealing how a prolonged social-engineering campaign can undermine even sophisticated cryptocurrency infrastructure. The incident, which the exchange attributes to North Korea-linked attackers following an FBI assessment, highlights a broader challenge for digital-asset markets: exchange security depends not only on blockchain technology and wallet architecture, but also on employee access, internal systems and operational controls.

A Recruitment Process Became the Entry Point

According to Binance Chief Security Officer Jimmy Su, an engineer was approached in September through a legitimate recruitment platform by an individual posing as a project director. The attackers reportedly used a fake human-resources representative and a second interview with someone claiming to be a company chief executive to establish credibility. The engineer was eventually instructed to download a coding assignment onto a work computer. The file contained zero-day malware that evaded endpoint security protections.

The disclosure also points to an earlier compromise. In June, another engineer reportedly installed a tampered Homebrew package while searching for an artificial-intelligence tool. Binance detected the issue and replaced the affected device, but said the engineer and colleagues on the wallet team remained exposed. These episodes suggest that the attackers pursued multiple routes into the organization rather than relying on a single compromised account.

How the Attack Reached Binance’s Hot Wallets

The campaign moved from employee devices into internal wallet infrastructure. Binance said that on October 20, attackers used the machine compromised through the fake interview, alongside an internal AI tool, to reach the computers of two wallet engineers. On October 29, stolen credentials were used to deploy a container and execute a malicious script. Funds began leaving the affected wallet at 20:05 UTC.

The attackers exploited Ethereum’s EIP-7702, a mechanism that allows externally owned accounts to temporarily delegate execution to smart-contract code. Binance said the attackers used it to establish unauthorized execution rights over a hot wallet, enabling transfers outside the exchange’s normal withdrawal process. The exchange’s use of multiparty computation did not provide an immediate way to revoke the malicious permission because no single key could independently cancel it. Containment was completed at 00:10 UTC on October 30, approximately four hours after the transfers began.

Recovery Measures and Institutional Implications

Binance CEO Richard Teng said approximately $2.85 billion had been frozen and that the company had replenished around 98% of the affected tokens using corporate funds. The exchange stated that users would not be affected by the replenishment. These figures indicate a substantial financial response, although frozen assets and company-funded replenishment are distinct measures and should not be interpreted as proof that all stolen funds have been recovered.

Binance also said it had blocked 57 suspected North Korea-linked attempts during the year and would engage independent cybersecurity specialists to review the incident. For institutional participants, the disclosure reinforces the importance of evaluating exchanges beyond trading liquidity and reported reserves. Employee-device security, recruitment verification, credential management, wallet permissions and incident-response procedures are equally relevant to custody and counterparty assessments.

Attention will now turn to the findings of the independent review, the status of frozen assets and whether Binance introduces additional controls around employee access and hot-wallet authorization. The incident also raises questions for the wider industry about how emerging blockchain features are integrated into institutional wallet systems. As attackers increasingly combine social engineering with technical exploits, the resilience of crypto platforms will depend on securing the entire operational chain—from recruitment and endpoint devices to signing infrastructure and transaction authorization.