Binance: $6.34B hack began with a fake job interview

On Nov. 3 Binance published its first report on the Oct. 29 hack: attackers the FBI ties to North Korea moved out about $6.34 billion in assets, and the operation started with a fake job interview of a Binance engineer. About $2.85 billion was frozen or intercepted, and Binance says it has already replenished 98% of the affected tokens from its own funds. The report appeared around 9:30 a.m. ET.

Details

According to Binance's report, this was a multi-stage campaign, not a one-off phishing attempt:

• June. A wallet DevOps engineer downloaded a tampered Homebrew installer while searching for an AI coding tool. Security spotted the anomaly, replaced the device and rotated credentials, but details about the wallet team were already exposed.
• September. A second engineer was approached on a job platform by a "project director." A fake HR rep ran the first video interview, and a "CEO of a fictitious company" ran the second in a chat app. At the end the engineer was told to download an "assignment" to his work computer; the code infected it, and endpoint tools did not catch the zero-day malware.
• Oct. 20. From that machine and an internal AI tool, the attackers took control of two more wallet engineers and found a container-deployment token.
• Oct. 29, 17:15⁠–⁠19:56 UTC. With the stolen credentials they deployed a container and ran a malicious script.

Funds left from hot wallets: between 20:05 and 20:09 UTC five wallets sent 233.46 million XRP, followed by about 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers then used the signing service to abuse Ethereum's EIP-7702 and gave their own smart contract partial execution rights over a hot wallet. Because the wallet used MPC, there was no single key to revoke them, which stretched containment. The last transfer, 2,961.9 ETH, finalized at 23:56 UTC, and at 00:10 UTC on Oct. 30 Binance cleared the delegation.

Binance also said it detected and prevented 57 suspected North Korea-linked cases in 2026. The FBI attributed the attack to North Korea. Binance says it, not users, will absorb the loss. The report is preliminary, independent firms will review it, and some technical details are withheld.

What this means for the market

This is Binance's first official account of how the breach happened; until now the picture rested on on-chain data. The lesson for the industry is that people and internal AI tools were the weak link, not wallet cryptography. We follow the timeline and the resumption of withdrawals in our hack timeline and in the note on phased withdrawals.

For the bitcoin price, see the daily brief. This is not investment advice.