Press play to start listening
Binance explains how North Korean hackers used fake job interviews, malicious developer tools and an internal AI tool in its $6.34 billion cryptocurrency theft.
Binance says a fake job interview process and abuse of an internal AI tool helped attackers reach its wallet infrastructure before the October 29, 2026 theft of $6.34 billion in cryptocurrency. Its initial incident report, published on November 3, traces the campaign through the compromised devices of three engineers.
As Hackread.com previously reported, the FBI attributed the attack to North Korea.
The exchange has stated that it would cover the financial losses. Binance co-CEO Richard Teng addressed concerns over the financial impact in a statement on X, saying, “We are committed to covering all hacked losses through our company funds. Your assets are safe.”
Fake Recruitment Led to Wallet Access
In its latest incident report, Binance traced the campaign back to June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Although Binance detected the activity, replaced the device and rotated credentials, the attackers learned the employee’s role and connections within the wallet team.
In September, another engineer, identified as Engineer B, was approached through a job-hunting platform by someone posing as a recruiter. The second interview ended with Engineer B being asked to download a coding assignment onto his work laptop.
Binance says the repository contained malware that replaced a legitimate pyenv file with a malicious one, giving attackers a way to run their own commands on the machine and contact a server they controlled.
On October 20, the attackers used Engineer B’s compromised computer and an internal AI tool to gain access to the devices of Engineer A and another wallet engineer, identified as Engineer C. Engineer A’s computer held a container deployment token. Binance has not explained how the AI tool enabled that access.
Attackers Abused Ethereum’s Authorization Mechanism
On October 29, the attackers accessed Engineer C’s computer and used credentials stolen from Engineer A to deploy a container and launch a malicious script. Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP. Wallets on Solana and Optimism subsequently sent approximately 970,500 SOL and 44.2 million OP, followed by 18,270 BTC.
The attackers also abused Ethereum’s EIP-7702 account-authorization mechanism, which allows an account to delegate certain execution rights to a smart contract. This gave an attacker-controlled contract partial execution rights over a Binance hot wallet without exposing its private key.
Suspending withdrawals could not immediately stop these on-chain authorizations. Binance said its multi-party computation (MPC) wallet setup meant there was no single private key available to revoke them immediately.
The exchange acknowledged the difficulty in its incident report, stating, “These challenges extended the time required to fully contain the unauthorized asset movements.”
The final unauthorized transfer, involving 2,961.9 ETH, settled at 23:56 UTC after having been broadcast earlier and remaining pending. Binance cleared the malicious delegation at 00:10 UTC on October 30.
As of its November 3 report, Binance said approximately $2.85 billion had been frozen or intercepted, with the figure subject to reconciliation and market price changes. Separately, it said 98% of the affected token assets had been replenished by October 31.
That replenishment represents replacement assets, not the recovery of 98% of the stolen funds. Binance said it had rebuilt affected systems, replaced compromised devices and tightened access controls. The investigation remains ongoing, and independent cybersecurity firms will review its findings.
This incident follows another major North Korean-linked crypto theft. In February 2025, attackers stole approximately $1.5 billion from Bybit in an operation the FBI attributed to North Korea. Hackread.com reported on the theft and the subsequent investigation linking it to the Lazarus Group.
Commenting on Binance’s findings, Gina Cardelli, Director of Platform and Threat Intelligence at Fortra, questioned how the compromised employee device enabled access to sensitive systems.
“My questions would be around the security controls surrounding that employee’s environment. “An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”
(Photo by Bastian Riccardi)
