Binance Heist: Fake Job Interviews Led To $6.3B Loss

A Sophisticated Breach Of Wallet Infrastructure

Binance has revealed the intricate details of a massive security breach that resulted in the theft of approximately $6.34 billion in cryptocurrency. The operation was a multi-stage attack that combined social engineering, custom malicious software, and the exploitation of internal tools to compromise the exchange’s wallet signing service. While a significant portion of the assets—roughly $2.85 billion—has since been frozen or intercepted, the scale of the heist highlights the evolving threats facing digital asset platforms and the vulnerabilities inherent in human-centric security.

The breach began in June when a company engineer inadvertently downloaded malware. This initial slip provided the attackers with a critical foothold, exposing the specific roles of several employees responsible for the infrastructure of the company’s cryptowallets. This reconnaissance phase allowed the hackers to identify high-value targets within the organization, setting the stage for a more targeted social engineering campaign that would eventually lead to the compromise of the exchange’s most sensitive systems.

The Recruitment Scam And Malware Deployment

In September, the attackers transitioned to a recruitment scam. A software engineer was contacted via a legitimate job-hunting platform by an individual impersonating a Project Director from a fictitious company. To build trust, the scammers orchestrated a two-stage interview process. The first round involved a live video call with a fake human resources representative who shared personal photos and videos to appear authentic. The second round took place on a popular social chat application with an individual claiming to be the company’s chief executive.

During this second interaction, the engineer was instructed to download a coding assignment from an online repository. This file contained a sophisticated 0-day malware that bypassed endpoint security and antivirus tools. The malware utilized advanced obfuscation techniques, replacing a legitimate development tool component within the macOS Homebrew directory with a malicious version. Specifically, the malicious script created a replacement executable named pyenv_ in the directory, deleted the legitimate pyenv executable, and renamed the malicious file to pyenv. This allowed the attackers to spawn a Z shell (zsh) process and establish a communication channel with an external server to execute remote commands on the employee’s device.

Escalation And The Final Raid

By October 20, the attackers leveraged the compromised computer and an internal AI tool to expand their reach. They successfully compromised two additional employees working on the wallet infrastructure, obtaining critical credentials and a container deployment token. This lateral movement within the system gave the hackers the necessary access to target the core signing services of the wallets. The attackers took deliberate steps to conceal their malicious activity and remove traces of the compromise, making the subsequent investigation more challenging for the security team.

On October 29, the attackers used the stolen credentials to deploy a malicious script. This script granted them unauthorized access to the wallet signing service, enabling the transfer of billions of dollars across multiple blockchains. The hackers further exploited Ethereum’s EIP-7702 authorization mechanism, which allowed them to continue draining assets even after the exchange had suspended withdrawals in an attempt to stop the bleed. This technical loophole ensured the attackers could maintain control over the assets despite the emergency measures taken by the exchange.

In the aftermath of the attack, Binance reported that 98% of the impacted token assets had been replenished by October 31. The company has since rebuilt the affected systems, replaced all compromised hardware, and revoked the stolen credentials. Independent security firms have been brought in to review the findings and ensure the integrity of the rebuilt infrastructure. This incident aligns with known patterns of state-sponsored cyber activity, such as the Contagious Interview and Operation Dream Job campaigns, which use fake job offers to trick developers into installing malware. Binance has issued an apology to its users and partners for the disruption and uncertainty caused by the event.