Binance says a fake recruitment assignment helped attackers gain access to employee computers before the October 29 hack. Its initial findings describe a campaign that eventually reached an internal service used to authorize wallet transactions, affecting approximately $6.34 billion in assets.

The November 3 update expands Binance’s earlier account of a compromised engineer’s laptop. It also explains why suspending withdrawals failed to stop every transfer: attackers had established permissions on Ethereum that required separate action to revoke.

A recruitment process concealed malicious software

According to Binance, a software engineer was approached through a legitimate job-search platform in September. Someone posing as a project director arranged interviews with a supposed HR representative and the CEO of a fictitious company.

Near the end of the second interview, the engineer was asked to download a coding assignment onto a work computer.

Binance says the assignment contained malicious software that ran during setup. It replaced part of a legitimate development tool and connected to an attacker-controlled server, escaping detection by the device’s security tools at the time.

The exchange also disclosed an earlier June incident involving a tampered software installation downloaded by another engineer. Binance says it replaced that device and changed related credentials, although the incident exposed information about its wallet infrastructure team.

Access spread through an internal AI tool

On October 20, the attackers used the compromised computer and an internal AI tool to gain control of two colleagues’ computers, Binance said.

They discovered a credential allowing software deployment within the wallet infrastructure. On October 29, they used the stolen access to deploy software and launch the theft.

The attackers reached Binance’s wallet-signing service, enabling transfers outside the normal withdrawal process.

On Ethereum, they also used EIP-7702, a feature allowing a wallet to delegate certain functions to software. That permission let attacker-controlled code continue moving assets after Binance suspended withdrawals.

Binance says its wallet’s security design complicated emergency revocation. The team developed a specialized procedure and cleared the delegation at 00:10 UTC on October 30.

Binance rebuilds systems as review continues

Binance says it has rebuilt affected wallet systems and its internal AI tool, replaced compromised devices, and disabled related credentials.

It reports approximately $2.85 billion frozen or intercepted, with the amount subject to reconciliation and changing prices.

The company says it has reserved more than enough funds to cover the loss and is purchasing outstanding affected assets. Independent security firms will review its initial findings as the investigation continues.

Final Summary

  • Binance says a fake recruitment assignment introduced malware that helped attackers reach its wallet-signing infrastructure.
  • The exchange has rebuilt affected systems and is arranging an independent review of its initial findings.