Binance traces $6.34bn hack to fake job and wallet access

Binance says a fake job interview helped attackers reach its wallet systems before about $6.34 billion in digital assets were affected on Oct. 29. In its initial incident report, the exchange describes a months-long campaign that began with malware on an employee’s work computer and ended with unauthorized transactions from hot wallets.

How did a job interview give attackers a foothold?

In September, Binance says, a software engineer was contacted on a legitimate job-hunting platform by someone posing as a project director. A purported human resources representative interviewed him by video and shared social media photos and videos to build trust. In a second interview, conducted through a social chat app, a supposed company CEO asked the engineer to download a coding assignment to his work computer.

The assignment contained a malicious code repository. Binance says its code ran during setup, replaced part of a legitimate developer tool with a malicious version, and contacted an attacker-controlled server. The malware evaded the endpoint security tools in place at the time. Binance describes this as one stage in a wider campaign, which also included malicious software and compromised software packages.

How did the attackers reach Binance’s wallets?

Binance says the compromised computer and an internal AI tool helped the attacker gain access to other employees’ systems. The attacker found a container deployment permission token on a wallet DevOps engineer’s computer. On Oct. 29, the attacker used stolen credentials to access another engineer’s computer, deploy a container and run a script that reached wallet signing operations.

A wallet signing service authorizes transactions. Binance says the attacker used unauthorized access to that service to initiate transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to attacker-controlled addresses. Binance also reported transfers of about 970,500 SOL, 44.2 million OP and 18,270 BTC.

Why did suspending withdrawals not stop every transfer?

The attacker also used Ethereum’s EIP-7702 authorization mechanism to give a malicious smart contract partial execution rights over a Binance hot wallet, according to the exchange. A smart contract is code that runs on a blockchain. Binance says the on-chain permissions could continue to work independently of its normal withdrawal system, even after it suspended withdrawals.

Binance says it needed a specialized process to revoke those permissions because the wallet used multi-party computation, which distributes signing authority rather than keeping one private key in one place. The final unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC on Oct. 29. Binance reported no further unauthorized transfers afterward.

The FBI attributed the incident to North Korea, according to Binance’s report. As of Nov. 3, Binance said about $2.85 billion had been frozen or intercepted, and that 98% of the affected token assets had been replenished by Oct. 31. The exchange said its investigation was ongoing and would undergo independent review.

Source material

• initial incident report — binance.com