Taiz:Cryptocurrency exchange Binance has revealed that hackers executed a sophisticated attack by using fake job interviews to compromise an employee's computer, resulting in the theft of approximately $6.34 billion in digital assets on October 29.
According to Anadolu Agency – English, Binance reported that the attackers tricked an engineer into downloading malicious software through a fraudulent recruitment process. The FBI attributed the attack to North Korea, and Binance has committed to covering the losses, having already replenished 98% of the affected tokens by October 31. The exchange is in the process of purchasing the remaining tokens that are less actively traded.
The incident began in September when a fake recruiter contacted the engineer via a job platform. Following several video interviews, the engineer downloaded a coding assignment that contained malware, which bypassed the company's security measures. On October 20, the attackers utilized the compromised computer and an internal AI tool to access other employees' devices. By October 29, they had accessed a service responsible for signing wallet transactions, enabling them to transfer funds outside the exchange's standard withdrawal process.
Between 2005GMT and 2009GMT on October 29, the attackers managed to transfer 233.46 million XRP tokens from five Binance wallets to their control. They also moved around 970,500 SOL tokens, 44.2 million OP tokens, and 18,270 bitcoin. Despite Binance suspending withdrawals upon receiving alerts of large transfers, the attackers exploited an Ethereum feature, EIP-7702, to authorize a malicious contract, allowing unauthorized transfers to continue even after the suspension.
The last unauthorized transfer occurred at 2356GMT, involving 2,961.9 ether. Binance revoked the authorization 14 minutes later, ceasing further unauthorized transfers. Approximately $2.85 billion in assets have been frozen or intercepted with the help of industry partners. The company has rebuilt the affected wallet system and AI tool, replaced compromised devices, and revoked stolen credentials. The investigation is ongoing, with independent cybersecurity experts expected to review the findings.