Hackers drained about $6.3 billion from Binance in minutes after a fake job interview planted hidden malware that reached an internal wallet system.
Story Highlights
- Binance says a fake recruiting process delivered malware to an engineer’s laptop.
- On-chain activity shows a delegated authorization used to empty an Ethereum hot wallet.
- Roughly $6.3 billion moved across about ten blockchains in about 20 minutes.
- Binance says it has replenished about 98% of affected assets and rebuilt systems.
How the attack allegedly began with a fake interview
Binance co-chief executive Richard Teng said attackers posed as recruiters and ran interviews in September. He said they sent a coding test that hid malware able to evade defenses. He said the malware reached an internal artificial intelligence tool and a service container that could submit withdrawals. Binance’s preliminary report also pointed to a compromised DevOps engineer laptop linked to later stages of the breach. The company described its findings as preliminary while it completed deeper forensics.
Federal advisories describe this style of social lure targeting crypto workers. A joint advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Treasury Department says North Korea-linked groups have since 2020 used recruiting messages and booby-trapped apps to hit developers and DevOps staff. That pattern explains why the interview story fits known tactics, even as formal attribution for this case has not been published in the record cited here.
What on-chain data shows about the wallet drain
Blockchain analysts reported fifty pre-signed Ethereum authorizations under the EIP-7702 change, with one matching the wallet’s transaction count. That authorization delegated the Binance wallet to attacker contract code. The attacker then used that contract to sweep the wallet’s funds. Reports emphasize this explains the Ethereum loss path. It does not, by itself, map each of the other reported blockchains used during the same window.
Independent tracking estimated that about $6.36 billion left Binance wallets across roughly ten blockchains. Most of that movement happened within around twenty minutes, which limited response time and made freezing some assets harder. The reporting describes a mix of token types and networks, with some assets more recoverable than others due to issuer and exchange controls that can freeze or reissue tokens.
What Binance says it restored and what it rebuilt
Teng said Binance replenished about 98% of the roughly $6.34 billion in affected assets. He said the company repurchased illiquid tokens that were harder to source. He also said Binance rebuilt the affected wallet system and the internal artificial intelligence tool, replaced compromised devices, turned off related credentials and tokens, and expanded security scans on staff devices. These steps line up with a response to an internal compromise pathway.
The company and several outlets used dollar figures ranging between $6.3 billion and $6.36 billion. That spread reflects price swings and timing of valuation. Reports also note that the EIP-7702 mechanism may have amplified losses by making a single authorization highly powerful, though some coverage argues the protocol did not cause the breach on its own. The precise role of internal signing and approval controls remains a subject of technical review.
Why this matters beyond crypto
This heist shows how one tricked employee can open a door to a massive loss, even at a giant platform. Many Americans see elites building complex systems that still fail basic tests. When billions can vanish in minutes, it feeds a belief that powerful players protect themselves first, and the public last. Clear controls, simple checks, and honest accounting build trust. Fancy tools without accountability do not.
FBI attributes the record Binance heist to North Korea’s TraderTraitor: $6.43 billion taken across 11 blockchains — The FBI, with the Secret Service and IRS Criminal Investigation, now formally…#CyberSecurity #InfoSechttps://t.co/2NNQJ2fSXR
— Jim Nitterauer (@JNitterauer) November 3, 2026
For readers, a few habits help. Treat job outreach and coding tests with care, even if they look real. Use separate devices or sandboxes for unknown files. Ask how companies secure hot wallets and authorizations. Look for plain-language reports on what was lost, what was frozen, what was returned, and how values were set. That level of detail, paired with audits or attestations, helps cut through hype and restores confidence, step by step.
Sources:
insiderpaper.com, securityweek.com, perplexity.ai, lcx.com, en.wikipedia.org
