Fake job interview opened the door to $6.34 billion Binance heist
A tampered software installer and a fake job interview gave attackers the access they needed to steal about $6.34 billion in digital assets from Binance.
“It was not a single isolated breach or a simple phishing incident,” Binance wrote in its incident report.
“The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”
The money left Binance wallets on October 29, in what is likely the biggest crypto heist in the history. Tether, Circle and other partners helped freeze close to $3 billion of the stolen funds within the first day, and the exchange promised to cover all user losses.
The FBI later confirmed that North Korea was responsible, tying the attack to TraderTraitor, the group also responsible for the $1.5 billion Bybit hack of February 2025. Binance began restoring withdrawals in phases on November 1.
A breach that started in June
In June, an engineer on Binance’s Wallet DevOps team went looking for a popular AI coding tool and ended up installing a tampered version of Homebrew, the package manager used on Macs. The company’s security team caught the problem, replaced his device and reset his credentials, though by then the attackers had already learned his role and the names of his colleagues on the wallet infrastructure team.
In September, hackers returned with a fake job offer. This time they went after a different employee, a software engineer who, according to the report, “was contacted through a legitimate job-hunting platform by an individual posing as a Project Director.” His profile on the platform “referenced his experience at Binance,” and the fake director lined up a first-round interview with an HR representative, followed by a second-round interview “with an individual claiming to be the CEO of a fictitious company.”
After a live video screening, he was asked to download a code repository onto a company-issued computer as part of an assessment. The code hid zero-day malware, and once it ran, it swapped the legitimate pyenv executable in the Homebrew directory for a malicious copy and used it to launch a Z shell (zsh) process. “The 0-day malware was not detected by the endpoint security protection tools at the time,” the exchange admitted.
On October 20, the attackers used that computer and an internal Binance AI tool to gain control over two more engineers, the Wallet DevOps engineer targeted in June and a wallet software engineer. Binance’s report states that they soon found out the DevOps engineer “had a container deployment permission token on his computer.”
On the day of the theft, the attacker logged into the wallet software engineer’s computer with the credentials stolen from the DevOps engineer, deployed a container and ran a malicious script that launched the attack. The exchange’s preliminary findings indicate unauthorized access to its internal wallet-signing service.
“The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet,” Binance explained.
Binance cleared the EIP-7702 delegation code from its Binance14 hot wallet the next day. One transaction that had already been broadcast went through afterwards, and Binance reports no other unauthorized transfers since.
The comany has since scanned all employee devices and brought in independent security firms to go over its work. “The investigation remains ongoing and our findings will be subject to further independent review,” it noted, adding that it shared the initial report “because security improves when the industry learns together.”
A familiar North Korean playbook
Luring victims with fake job offers to get them to install malware is nothing new for North Korean hackers, and the trick has become their modus operandi. The Lazarus group used it in Operation Dream Job, a long-running campaign in which the attackers pose as recruiters and dangle jobs at well-known companies.
In 2025, ESET researchers tracked a wave of the campaign that hit three defense companies in Central and Southeastern Europe, some of them involved in drone development, with job offers that came with a malware-laced PDF reader. This August, Check Point found Lazarus pairing fake job offers with trojanized PDF software and a Windows zero-day in attacks aimed mostly at the defense sector.
In an interview with Help Net Security in April, Kaja Ciglic, Senior Director, Cybersecurity Policy and Diplomacy at Microsoft, said North Korea’s cyber program blurs the line between espionage, warfare and organized crime.
“North Korean cyber operations are best understood as a state‑directed criminal enterprise, where revenue generation is a core objective. Cryptocurrency theft, supply‑chain compromise, and illicit IT worker schemes directly fund state priorities,” she explained.
“Our existing legal frameworks struggle because they assume clean distinctions between espionage, crime, and armed conflict. In practice, this convergence demands closer coordination between financial regulators, cyber defenders, and national security authorities—responses designed for one domain alone are no longer sufficient.”
Blame and lessons after the heist
Binance co-CEO Richard Teng, who discussed the incident on CNBC, wrote on X that the exchange is “now 98% replenished” and has finished its latest Proof of Reserves verification, “giving users another way to independently check that their assets are backed.” He added that “while Binance is at the centre of this story, this is an industry-wide problem.”
Binance co-founder Changpeng Zhao took a harder line on X, saying “some details are embarrassing.”
“A hack of this scale means serious security failures occurred. No platform is unhackable, but that cannot be an excuse.”
He went on to say that public explanations “simplify what appears to have been a prolonged multi month/year attack targeting hundreds of employees and systems, with a few ultimately compromised.” Speaking as a shareholder, Zhao expects Binance “to be transparent about what went wrong, take responsibility, learn from all criticism, and make meaningful improvements.”
Binance’s choice to call the malware a zero-day drew a sharp response from vulnerability analyst Will Dormann. “No. There is no such thing as ‘0-day malware’. You had two employees who got convinced to download and execute malware, which happened to be undetected by whatever magic protection you believed in,” he posted on Mastodon.
“‘0-day’ is not a term you sprinkle into your words to convey ‘It’s not our fault’,” he added.
“It has long been said that the cost of hiring a new employee is significantly higher than paying to retain an existing employee. It seems to for Binance, that cost was astronomically higher. In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time,“ said Tyler Reguly, Associate Director, Security R&D at Fortra.
“Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user,” concluded Reguly.
