Binance Says Hackers Used Fake Job Interviews And Malware To Breach Its Security Systems

Cryptocurrency exchange Binance was hit by a major security breach on October 29, with approximately $6.34 billion in digital assets impacted. The exchange said around $2.85 billion had been frozen or intercepted. In a November 3 statement, Binance detailed how attackers used fake recruitment interviews, malicious software and an internal AI tool to gain access to its systems.

How Hackers Used Fake Job Interviews And Malware To Gain Access

According to the release, attackers approached one of Binance's software engineers through a legitimate job-hunting platform in September. Posing as representatives of a fictitious company, they arranged two interviews with individuals claiming to represent its human resources department and CEO.

During the second interview, the employee was asked to download a coding assignment onto his work computer. Binance said the assignment contained a malicious repository with malware that ran during setup, allowing attackers to execute commands on the computer and communicate with an external server.

The attackers also replaced a component of a legitimate development tool with a malicious version. The exchange said its endpoint security tools did not detect the malware at the time. The attackers concealed their activities and removed traces of the compromise.

Binance also reported an earlier incident in June involving another employee who downloaded a tampered Homebrew installation while trying to install an AI coding tool. The exchange said it detected the issue, replaced the device and rotated related credentials. However, the employee's role and connections within the wallet infrastructure team had already been exposed.

How Hackers Accessed Binance's Wallet Systems

On October 20, attackers used the compromised employee's computer and an internal AI tool to gain access to the systems of two other employees, including a Wallet DevOps engineer, the release said.

They found a container deployment permission token on the engineer's computer, which allowed them to deploy containers within Binance's systems.

Between 17:15 and 19:56 UTC on October 29, the attackers accessed another employee's computer using credentials stolen from the Wallet DevOps engineer. They deployed a container and ran a malicious script, gaining unauthorised access to Binance's internal wallet-signing service, which is used to approve cryptocurrency transactions.

The exchange said the attackers used this access to initiate transfers outside its normal withdrawal process. They also exploited Ethereum's EIP-7702 feature to give a malicious smart contract partial execution rights over one of Binance's hot wallets. The feature allows an account to delegate certain actions to a smart contract.

Binance said suspending withdrawals alone could not stop all unauthorised transfers because the malicious permissions had already been recorded on the blockchain and operated separately from its normal withdrawal infrastructure.

The final unauthorised transfer, involving 2,961.9 ETH, was finalised on-chain at 23:56 UTC on October 29. Binance said it cleared the malicious permissions at 00:10 UTC on October 30 and that no further unauthorised transfers were observed after that.

What Binance Did After The Security Breach

Binance said it rebuilt the affected wallet system and its internal AI tool, along with the controls governing access to them. It also replaced affected devices, decommissioned credentials and access tokens linked to the incident, and conducted additional security checks across employee devices.

The exchange said it strengthened controls over its wallet systems and improved AI-based monitoring to detect unusual activity. It also worked with law enforcement agencies, blockchain intelligence firms and industry partners to trace and freeze affected assets.

Binance said it was engaging independent cybersecurity experts to review the incident, validate its findings and recommend further security measures. It also outlined plans to increase investment in AI-based threat detection, employee-device protection and the security of software development environments.

Separately, Binance had resumed cryptocurrency withdrawals in phases after temporarily suspending them following the security incident.