Binance Reports $6.34 Billion Theft Began With Fake Job Interview

Cryptocurrency exchange Binance has released its first public account of a massive security breach, revealing that a $6.34 billion theft on October 29 began months prior with a fake job interview and a compromised developer tool. According to the exchange, the multi-month operation allowed attackers to infiltrate infrastructure and manipulate wallet operations before any funds were moved. Among people searching for updates on the platform, many are looking into the scale of the digital assets involved in the incident.

Co-CEO Richard Teng and chief security officer Jimmy Su detailed a sophisticated campaign combining poisoned software downloads, staged recruitment processes, evasive malware, and internal AI tools that attackers turned against the company's own wallet engineers. The first foothold was established in June when a DevOps engineer searching for an AI coding tool downloaded a tampered installer. Although security teams detected the anomaly and rotated credentials, the episode exposed key staff details.

In September, a second engineer was approached on a legitimate job platform by individuals posing as project directors and HR representatives. After video interviews, the victim was given a coding assignment that installed a malicious version of a pyenv component, opening a channel to an attacker-controlled server. By October 20, the attackers used that machine and an internal AI tool to reach additional engineers, eventually logging into a computer on October 29 to deploy containers with stolen credentials and execute the drain.

Binance revealed that a $6.34 billion October theft started with a fake job interview and poisoned developer tools.

The attackers utilized compromised signing services to invoke Ethereum's EIP-7702, establishing on-chain delegations that operated outside standard withdrawal infrastructure. Despite suspending withdrawals, the attackers had already submitted multiple signing transactions. Binance stated it has frozen or intercepted approximately $2.85 billion of the stolen assets and replenished 98 percent of affected tokens from its own reserves.

The FBI has attributed the campaign to North Korea, a finding cited in the Binance report. Meanwhile, the incident has drawn attention in Washington, where officials discussed regulatory oversight for offshore exchanges. Binance has since rebuilt its wallet systems, replaced affected hardware, expanded anomaly detection, and commissioned an independent review.

Why it matters The incident highlights severe vulnerabilities in developer environment security and the growing sophistication of social engineering tactics targeting cryptocurrency infrastructure. By detailing how attackers weaponized recruitment platforms and internal AI tools, the report provides critical lessons for digital asset security across global markets.