Binance details five-month intrusion, says fake job interview infected employee's PC

Attackers first got into a Binance employee's computer through an assignment handed out in a fake job interview. In its initial report, posted on its official X account on the night of Nov. 3 KST, Binance said about $6.34 billion in digital assets was impacted in the Oct. 29 (UTC) incident, and that over five months the attackers took over employee computers and an internal AI tool in turn before reaching its wallet signing service. Of that amount, about $2.85 billion has been frozen or intercepted.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused"

Binance initial incident report

Binance said it, not its users, will absorb the loss, adding that 98% of the impacted token assets had been replenished as of Oct. 31 and that it is buying the remaining, less liquid coins. The report cited the latest information from the U.S. Federal Bureau of Investigation (FBI) in naming North Korea as responsible. The attack path was as follows (times in KST).

1. JuneWallet DevOps Engineer A downloads a tampered Homebrew installation (a package installer for Mac) found through a search engine to install an AI coding tool. The security team spots the anomaly, replaces the device and rotates credentials, but the roles of A and his wallet infrastructure colleagues are already exposed
2. SeptemberEngineer B is contacted on a job platform by a fake "Project Director" and goes through two interviews. An assignment received at the end of the second interview infects his work computer
3. Oct. 20Using B's computer and an internal AI tool as a springboard, the attacker takes control of the devices of A and wallet engineer C, and finds a token granting container deployment permissions on A's computer
4. Oct. 30, 2:15–4:56 a.m.Logs on to C's computer, deploys a container with A's credentials and triggers a malicious script
5. Oct. 30, 5:05–5:09 a.m.Five hot wallets send out 233.46 million XRP. About 970,500 SOL, 44.2 million OP and 18,270 BTC follow
6. Oct. 30, 8:56 a.m.The final unauthorized transfer (2,961.9 ETH) is finalized
7. Oct. 30, 9:10 a.m.Binance executes a new authorization clearing the malicious delegation. No further unauthorized transfers follow

The second interviewer posed as CEO of a nonexistent company

B had a profile on a legitimate job-hunting platform that referenced his experience at Binance. The person posing as a project director set up a first-round video interview with an HR representative and a second round with someone claiming to be CEO of a fictitious company. The first interviewer even shared a social media account with personal photos and videos to build trust. Binance said this was "more advanced and deceptive than previously seen social engineering approaches."

The second interview took place on a messaging app, and near the end B downloaded a code repository given as an "assignment" onto his work computer. Malicious code that ran during setup deleted a legitimate development tool file, pyenv, replaced it with a malicious file of the same name and connected to an external server. Because it was previously unknown zero-day malware, endpoint security tools at the time did not catch it, and the attacker also erased traces.

Why coins kept leaving after withdrawals were halted

The attacker used the wallet signing service to create transactions outside the normal withdrawal process. It then exploited Ethereum's EIP-7702 feature, which lets a wallet delegate some execution rights to a smart contract without exposing its private key. By submitting 50 signing transactions, the attacker gave its own smart contract partial execution rights over one Binance hot wallet.

Because those permissions were recorded on-chain, they did not disappear when Binance halted withdrawals and shut down hot wallet services. The hot wallet used multi-party computation (MPC), which requires several key shares to sign together, so there was no single private key to revoke the permissions immediately. Binance had to build a separate procedure to clear them, which took more time, and it was more than four hours from the first outflow to the removal of the delegation.

57 suspected North Korean attacks stopped this year

Binance said it detected and prevented 57 suspected North Korea-linked attacks this year. They used fake job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, and fake video conferencing apps. Since the incident, it has rebuilt the affected wallet system and internal AI tool in new environments, replaced affected devices and decommissioned the credentials and tokens of the engineers involved. It plans an independent review by outside security firms and a research fund with AI companies and security firms focused on AI security in blockchain environments.

North Korea pushed back. According to VOA, Kim Yo Jong called the FBI's finding "preposterous sophistry" and a "grave political provocation" in a statement carried by the Korean Central News Agency on Nov. 3. Markets were calm. Around 8:30 a.m. KST on Nov. 4, bitcoin traded at 104,978,000 won on Upbit, up 1.3% from the previous day, and at $77,914 on Binance. The kimchi premium (the gap between prices on Korean exchanges and global markets) was about 0.2%.