Binance hack: how a fake job interview led to the $6.3bn crypto theft
Binance's own report says the attack began months earlier with a poisoned download and a fake recruiter. Step by step, and the lesson for Pakistani freelancers.
New on Tuesday: Binance has published its own account of how hackers stole about $6.3 billion from it on 29 October, and it starts not with a clever code bug but with a fake job interview. Co-CEO Richard Teng said the attackers “spent months building their way in”. (Our earlier coverage: Binance withdrawals resumed.)
The FBI has already blamed North Korean hackers from the group known as TraderTraitor. Teng did not name the country himself, but he acknowledged the FBI’s finding in a TV interview on Tuesday.
The attack, step by step
According to the security report Binance released on Tuesday, 3 November:
- June: an engineer on the Binance Wallet team, searching online for an AI coding tool, installed a tampered copy of Homebrew, a popular program for installing developer software. Binance spotted it, replaced the laptop and changed the passwords, but the engineer and his wallet colleagues stayed on the attackers’ radar.
- September: a different software engineer was approached on a genuine job platform by someone posing as a project director. A fake HR person interviewed him on video, then a fake “CEO” held a second interview and asked him to download a coding assignment. He opened it on his work computer. Hidden inside was malware that Binance’s security software did not detect.
- 20 October: from that machine, the attackers used an internal Binance AI tool to reach the computers of two wallet engineers.
- 29 October: with stolen credentials they started a program inside Binance’s systems and ran a malicious script. Money began leaving at 20:05 UTC (1:05 AM on 30 October in Pakistan). They used a recent Ethereum feature, EIP-7702, to take control of a hot wallet, the online wallet exchanges use for daily withdrawals. Binance says it contained the attack at 00:10 UTC, about four hours later.
Where the money stands
- Binance says the affected assets were worth $6.34 billion and it has replaced about 98% of them from its own funds, so customers will not lose money.
- Nearly $3 billion of the stolen crypto has been frozen with help from partners including stablecoin issuers Tether and Circle, according to the company. The rest is still being moved through laundering channels.
- Binance says it blocked 57 suspected North Korea-linked attempts earlier this year.
The company has rebuilt the wallet system and the AI tool that was abused, replaced the infected devices, cancelled the engineers’ credentials and hired an independent expert to review what went wrong.
Why this matters in Pakistan
Thousands of Pakistani developers and freelancers hunt for remote work on job platforms every day, and “do this coding test first” is a normal request. That is exactly the door used here. A few rules that would have stopped this attack:
- Never run a take-home test or “sample project” on the computer you use for work, banking or your crypto wallet. Use a separate machine or a throwaway virtual machine.
- Download developer tools only from the official site, not from a search ad.
- Be suspicious when a recruiter moves fast, has a brand-new profile, or the “CEO” joins a first-round interview.
- If a call has “Zoom problems” and asks you to install an update or file, stop.
For Binance users here, nothing new needs doing: balances are covered, and withdrawals have been coming back in phases since 1 November. Pakistan’s crypto rules are still being set by the Pakistan Virtual Assets Regulatory Authority (PVARA), so local legal protection for exchange users is limited.
This is information, not investment advice.
