Binance reveals hack scheme involving fake job interviews and AI
Cryptocurrency exchange Binance has released preliminary findings from its investigation into the October 29 hack, which affected $6.34 billion in assets. The attackers infiltrated the company's infrastructure through fake job interviews, malware, and an internal AI tool.
According to the published report, the attack had been in preparation for several months. The hackers systematically gained access to employees' computers, stole credentials, and compromised a transaction signing service.
By November 3, Binance and its partners had frozen or intercepted approximately $2.85 billion. The company also allocated funds to fully cover user losses.
How hackers gained access to Binance crypto wallets
In September, the attackers contacted a Binance engineer through a job search platform. Posing as employees of a fictitious company, they conducted several interviews and asked the engineer to download a test assignment containing malicious code.
After the program was executed, the attackers gained access to the engineer's work computer. On October 20, they exploited an internal Binance AI tool to infiltrate the systems of two additional engineers responsible for cryptocurrency wallet infrastructure.
On October 29, the hackers used stolen credentials to compromise the transaction signing service. As a result, 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC were transferred from the exchange's hot wallets.
The attackers also exploited the EIP-7702 mechanism on Ethereum, which allows certain permissions to control addresses to be delegated to smart contracts.
As a result, simply suspending withdrawals did not stop the attack. The malicious permissions remained active directly on the blockchain, forcing Binance specialists to revoke them separately.
The final unauthorized transaction, involving 2,961.9 ETH, was completed late on October 29. The malicious permissions were fully revoked at 00:10 UTC the following day.
Binance restores 98% of assets and strengthens security
According to the exchange, 98% of the affected tokens had been replenished by October 31. The company reserved the necessary funds to compensate for the remaining losses.
Binance rebuilt the compromised systems, replaced employee devices, revoked credentials, and tightened controls over cryptocurrency wallets. The exchange also expanded its use of AI to detect suspicious activity.
According to the FBI, North Korea was responsible for the attack. The investigation remains ongoing, and Binance's preliminary findings are subject to independent verification.
Amid the incident, Binance founder Changpeng Zhao warned that advances in artificial intelligence make it easier to carry out sophisticated cyberattacks against cryptocurrency exchanges and banks. According to Zhao, automation lowers the technical barriers for attackers.
Earlier, we reported that Binance had confirmed its financial stability following the $6.3 billion hack. The exchange said it had sufficient reserves to cover user losses.
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
