Binance Traces $6.3B Hack to Fake Job Interviews and AI Tool
A months-long social engineering campaign exploited internal credentials to breach Binance's wallet infrastructure.
1Months-Long Infiltration Strategy
The $6.3 billion theft was not a single event but the culmination of a campaign starting in June 2026. Attackers systematically targeted Binance engineers through social engineering tactics, including fake job interviews and tampered AI coding tools. This prolonged approach allowed hackers to gather internal credentials before executing the final breach.
2Initial Malware Vector
The campaign began when an engineer downloaded a compromised software package while configuring an AI coding tool. Although Binance security teams detected the malware and replaced the device, the attackers had already successfully harvested critical information regarding the wallet team. This initial foothold proved essential for the subsequent phases of the attack.
3Social Engineering via Recruitment
In September, attackers posed as recruiters to target another software engineer. They successfully tricked the employee into downloading a malicious file disguised as a standard coding assignment. This malware bypassed existing security protections, granting the attackers unauthorized access to the engineer’s work computer and further internal network segments within the exchange.
4Escalation to Wallet Infrastructure
By October 20, the attackers leveraged the compromised computer and an internal AI tool to infiltrate two additional engineers' systems. This escalation allowed them to obtain specific deployment credentials. On October 29, they used these credentials to install malicious software directly into the wallet infrastructure, gaining control over the internal wallet-signing service.
5Exploiting EIP-7702 Mechanism
The attackers utilized Ethereum’s EIP-7702 mechanism to delegate transaction permissions to smart contracts. This technical maneuver enabled unauthorized transfers to persist even after Binance suspended withdrawals. The exchange's multiparty computation wallet system, designed to distribute signing control, inadvertently complicated efforts to revoke these permissions once the breach was identified by the security team.
6Financial Impact and Recovery
The breach resulted in the loss of $6.3 billion in digital assets. Binance reported that $2.85 billion was successfully frozen or intercepted. The exchange committed to absorbing the losses, confirming that 98% of affected token assets were replenished by October 31 to protect customer funds from the impact of the historic theft.
7Attribution and Political Denial
The FBI attributed the attack to North Korean hackers, citing a coordinated campaign. Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied these allegations, labeling the FBI's attribution as politically motivated. Despite the denial, Binance co-founder Yi He confirmed the exchange had previously blocked 57 similar North Korea-linked threats in 2026.
8Security Lessons for Exchanges
This incident highlights the severe risks posed by sophisticated social engineering targeting individual employees. While Binance intercepted dozens of prior attempts, the failure to stop this single campaign resulted in the largest cryptocurrency hack in history. The event underscores the necessity for rigorous verification processes regarding external software and recruitment-based interactions.