From the Blackmint News archive. Prices and details may have changed since publication.
Binance Says a Fake Job Interview Opened the Door to Its $6.34B Drain
Binance's first security report traces the Oct. 29 wallet drain to a tampered install in June and a rigged coding test in September.
A rigged job interview sits at the center of how attackers took about $6.34 billion from Binance on Oct. 29, according to the exchange's initial security report published Tuesday.
The attackers "spent months building their way in," co-CEO Richard Teng told CNBC's "Squawk on the Street" on Tuesday.
The four-month path
Binance said the first step came in June, when a wallet engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. Binance said it spotted odd activity, replaced the device and rotated credentials, but the team's roles had already been exposed. In September, a second engineer was approached through a job platform. After a video interview, a coding "assignment" carried malware built to slip past security tools, per the report and Unchained's summary.
On Oct. 20, the attackers used an internal AI tool to reach a container deployment token. On Oct. 29, they deployed a container, ran a script and moved funds from five hot wallets.
How does one token drain five wallets? A hot wallet is an online wallet an exchange uses for daily withdrawals. Binance said the attackers abused an Ethereum feature called EIP-7702, which lets an account hand signing power to code. Because Binance's wallets split keys across several parties (a setup called MPC), no single key could cancel that power quickly. The last transfer, 2,961.9 ETH, settled at 6:56 p.m. ET, and the access was cut at 7:10 p.m. ET, per Unchained.
The money
Teng told CNBC that 98% of the $6.34 billion has been replenished and that Binance is still buying harder-to-find assets. Binance's own earlier updates gave 90% on Oct. 31 and about 95% on Nov. 2, Unchained noted. Tether, Circle and Ripple have reportedly frozen about $3 billion, per CNBC.
Teng did not name North Korea, but acknowledged that the FBI has tied the attack to the TraderTraitor group. North Korea has denied the FBI's finding. Binance said it has rebuilt the affected systems and plans an independent review and a security research fund.
In our opinion: The scariest line here is the job interview, because any crypto engineer anywhere can get that email tomorrow. Binance's money story is getting better, but the 98% figure needs one clean, dated number everyone can check. Watch the independent review and whether withdrawals fully reopen.
Sources: Binance initial security report · CNBC · Unchained
Revisions
First published .
No revisions since publication.
We fix errors and say so. See every correction on the Blackmint corrections page.