Binance Hack: How Fake Job Interviews and AI Abuse Led to $6.34 Billion Loss
Attackers leveraged social engineering and internal AI tools to compromise Binance's wallet signing infrastructure.
1Sophisticated Multi-Stage Campaign
Binance confirmed a major security incident on October 29 involving a multi-stage campaign by the North Korea-linked Lazarus Group. Attackers utilized fake recruitment processes, malware, and internal AI tool abuse to breach critical systems. The firm estimates approximately $6.34 billion in digital assets were affected, with significant recovery efforts already underway.
2The Recruitment Infection Vector
The attack began by targeting software engineers through legitimate job-hunting platforms. Attackers posed as project directors, conducting video interviews to build credibility before requesting candidates download a technical assignment. This repository contained malicious code that executed during setup, effectively bypassing endpoint security tools to establish a persistent connection with attacker-controlled servers.
3Internal AI Tool Pivot
A critical turning point occurred when attackers used a compromised workstation to abuse an internal AI tool. By accessing the environment of a Wallet DevOps engineer, they discovered a token with container deployment permissions. This demonstrates how internal applications can become dangerous pivots when adversaries gain access to an employee's authenticated session.
4Bypassing Withdrawal Infrastructure
On October 29, attackers deployed a malicious container to access the internal wallet signing service. They exploited Ethereum's EIP-7702 mechanism to grant partial execution rights to a malicious smart contract. This allowed unauthorized transactions to occur independently of Binance's standard withdrawal infrastructure, complicating initial efforts to stop the massive asset outflow.
5Asset Impact and Recovery
The incident resulted in the unauthorized transfer of 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC. Binance successfully froze or intercepted approximately $2.85 billion of the stolen funds. The company has since replenished 98% of the affected token assets and is currently rebuilding its wallet infrastructure and internal security protocols.
6Broader Industry Threat Landscape
This incident aligns with global warnings regarding the 'Contagious Interview' campaign. Japan’s National Police Agency and the FBI have linked similar tactics to the 313 General Bureau of the Munitions Industry Department. These operations have infected over 30,000 devices globally, specifically targeting freelance developers and Web3 specialists through fake technical coding assessments.
7Historical Context of Lures
Recruitment-based attacks are a recurring theme in high-stakes cybercrime. The 2016 Bangladesh Bank hack and the 2022 Axie Infinity theft both utilized job application lures to gain initial access. These events underscore a persistent trend where attackers exploit the trust inherent in professional hiring processes to infiltrate highly secure financial environments.
8Strengthening Corporate Attack Surfaces
Binance recommends that companies treat recruitment processes and developer workstations as critical attack surfaces. Technical assignments must run in isolated environments, while deployment credentials should be short-lived and strictly restricted. Internal AI tools require robust access controls to ensure they cannot inherit excessive permissions that could lead to systemic infrastructure compromise.