Fake recruitment helped rob Binance. The stock exchange described the course of the attack

According to a November 3 Binance report, the October 29 attack was preceded by months of preparation, including a false recruitment of a programmer.

A malicious recruitment task downloaded to a company computer enabled a further attack on the stock exchange infrastructure.

Binance estimates the value of the stolen assets at approximately $6.34 billion. The description provided is preliminary and an independent review is yet to occur.

A Binance programmer received a job offer, underwent two mock interviews and downloaded the recruitment task to his work computer. According to the Binance report, this was one of the stages of preparation for the October 29 theft. The document, published on November 3, describes how attackers reached the transaction signing system. Previously, the FBI attributed the attack to North Korea, which is what the text about who is behind the Binance attack writes about.

Two interviews and a malicious recruiting assignment

In June, an engineer on the wallet team, while searching for a popular AI coding tool, downloaded a modified Homebrew installation. The security team detected the anomaly, replaced the device and changed the credentials. However, according to the exchange, the attackers learned the role of this employee and his connections with other wallet infrastructure engineers.

In September, another programmer received an offer on a job platform from someone posing as a project director. There were two conversations: a video with a fake HR representative who, for credibility, showed him her social media account, and then a chat with a person who introduced herself as the president of a non-existent company. At the end, he was given a “recruitment task”, i.e. a repository to be downloaded to his work computer. During the task installation, a script was executed that replaced the Python version management tool pyenv with a malicious version. According to Binance, computer security software did not detect the threat at that time.

A similar pattern is not new. A fake job offer was also behind the attack on Axie Infinity in 2022.

Binance attack timeline: June, September, October 20, October 29 withdrawals, October 30 removal of EIP-7702 delegation

On October 20, attackers used a compromised computer and an internal AI tool to take over the computers of two wallet team engineers, including June’s. They found an access token on his computer that allows him to run containers, i.e. the environments in which the software runs. On October 29, between 17:15 and 19:56 UTC, they logged into the second computer, used stolen permissions to launch a container with a malicious script and gained unauthorized access to the internal transaction signing service.

Are you reading us? Add bitcoin.pl to your preferred sources on Google

How the money was paid

The first transfers started at 20:05 UTC. Within four minutes, five Binance hot wallets, i.e. wallets used to process ongoing transactions, sent 233.46 million XRP to the attackers. Then approximately 970.5 thousand flowed out. SOL, 44.2 million OP and 18,270 BTC. The last unauthorized transaction, 2,961.9 ETH, was committed to the blockchain at 23:56 UTC; it had been sent earlier and was waiting for confirmation.

Stopping withdrawals on the exchange did not invalidate the permissions that the attackers had granted to their smart contract using the EIP-7702 mechanism. To establish them, they needed 50 signed transactions. With these, they could still move funds outside of Binance’s regular payout system. At 00:10 UTC On October 30, the exchange removed this delegation of authority from the hot wallet.

According to Binance, an additional difficulty was the construction of MPC, in which the signature is created by the cooperation of several parts of the system. There was no single private key that could be immediately used to de-delegate. The team had to prepare and perform a separate procedure.

Binance estimates the effects at approximately $6.34 billion. According to the report, assets worth approximately USD 2.85 billion. frozen or intercepted. The amount is still subject to negotiation and changes with cryptocurrency prices. The stock exchange also declares that by October 31 it had replaced 98% of the missing assets; in its announcement of November 2, it reported approximately 95%. Replenishing the reserves from your own funds does not mean recovering the same part of the loot. The stock exchange announces that it will cover the loss itself, and accuses North Korea of responsibility, citing the FBI. In 2026, it was supposed to detect and block 57 suspicious attempts related to this country.

Which VPN to choose? VPN Ranking 2026: Speed Test, Audits and Ratings

The weakest link

Łukasz Żeligowski, an expert at Kanga Exchange EU, said in a comment for bitcoin.pl before the report that security “is as good as the weakest of them. And usually the weakest link turns out to be a human.” However, Binance’s description also covers how computer security works, access to internal tools, and permissions to sign transactions. The fake recruitment was one stage of the attack, not a full explanation for the theft.

This is a preliminary description prepared by the exchange

Binance did not disclose the name of the AI tool used. The document is an interim report: the investigation is ongoing and the findings described are subject to an independent review. The report on the subsequent stages of the attack comes from the exchange itself.

What does this mean to you

If you are looking for a job in IT or crypto, check the company and recruiter through an independent channel before running the code you submitted. Don’t install an unknown task on your work computer. To evaluate it, use an isolated environment without access to company accounts, files and tokens. The virtual machine itself does not guarantee security. How to recognize phishing attempts is described in the guide on what phishing is.

In the company, it is worth checking who can run the software in systems that support wallets, where access tokens are stored, and whether taking over one computer allows you to gain permissions for subsequent ones.

The report does not separately describe the situation of Binance Poland accounts, which have only been operating in withdrawal mode since July 1, as described in the text that Binance is suspending services in Poland. It therefore does not resolve how the incident affected these accounts.

The reserve proof balance check applies to the date and cryptocurrencies covered by a specific report. Does not confirm current payout availability. The status of the selected asset and network must be checked in the official exchange panel. The next record of the reserves is scheduled for November 4, and the cryptographic proof is to be made available after the calculations are completed.