{"slug": "binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack", "title": "Binance reveals fake job interview and compromised AI tool behind $6.34B hack", "summary": "Binance's initial investigation report, released Tuesday, states that attackers behind the $6.34 billion hack on October 29 infiltrated its wallet infrastructure through a fraudulent job interview, previously undetected malware and a compromised internal AI tool. The attackers obtained a deployment permission token by October 20, deployed a malicious script on October 29, and used 50 signing transactions exploiting Ethereum's EIP-7702 mechanism to move 18,270 BTC, roughly 970,500 SOL, 233.46 million XRP and 44.2 million OP, with the final 2,961.9 ETH transfer completed at 23:56 UTC. Binance said about $2.85 billion in stolen assets had been frozen or intercepted and 98% of affected token assets replenished as of October 31, while the FBI attributed the theft to North Korea's TraderTraitor operation, which North Korea denies.", "body_md": "# Binance reveals fake job interview and compromised AI tool behind $6.34B hack\n\nAttackers infiltrated Binance's wallet infrastructure through malicious software and stolen credentials before exploiting Ethereum's EIP-7702 mechanism.\n\nBinance said attackers behind the $6.34 billion hack on October 29 used a fraudulent job interview, malicious software and a compromised internal AI tool to infiltrate its wallet infrastructure, according to an initial investigation [report](https://x.com/binance/status/2117626126214504729?a=dpp_iwOKpCwuOh0i7Cc&s=20) released Tuesday.\n\nThe attack began taking shape in September when a Binance software engineer was approached through a legitimate recruitment platform by someone posing as a project director. During a subsequent interview, the engineer was instructed to download a coding assignment containing malware onto his work computer.\n\nThe malicious code replaced a legitimate development tool component, allowing the attackers to execute commands and communicate with an external server. Binance said its endpoint security tools failed to detect the previously unknown malware.\n\nBy October 20, the attackers had used the compromised computer and an internal AI tool to gain access to two additional engineers, obtaining a deployment permission token that provided a path into the exchange’s wallet infrastructure.\n\nOn October 29, the attackers used stolen credentials to deploy a container and execute a malicious script, gaining unauthorized access to Binance’s internal wallet signing service.\n\n### Hackers exploited Ethereum authorization mechanism\n\nThe attackers used the compromised signing service to initiate unauthorized transfers across multiple blockchains, including 18,270 BTC, approximately 970,500 SOL, 233.46 million [XRP](https://cryptobriefing.com/markets/ripple/) and 44.2 million OP.\n\nThey also exploited [Ethereum](https://cryptobriefing.com/markets/ethereum/)’s EIP-7702 mechanism, which allows accounts to delegate execution rights to smart contracts. The attackers submitted 50 signing transactions to establish malicious authorizations that enabled them to move funds independently of Binance’s withdrawal infrastructure.\n\n### The news moving money, markets, and the world—before your day starts.\n\nDaily. Free. Join 34,000+ readers across crypto, finance, and policy.\n\nBinance suspended withdrawals and attempted to revoke the permissions, but the existing blockchain authorizations remained active. The exchange said its use of multiparty computation wallets complicated the process of removing the malicious permissions.\n\nThe final unauthorized transfer of 2,961.9 ETH was completed at 23:56 UTC on October 29. Binance revoked the affected wallet’s malicious delegation shortly after midnight on October 30.\n\n### Binance replenishes 98% of affected tokens\n\nBinance said approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of affected token assets had been replenished as of October 31.\n\nThe exchange said it had allocated more than enough funds to cover the losses and was purchasing the remaining less liquid assets.\n\nBinance has since rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices and revoked exposed credentials. It is also engaging independent cybersecurity firms to review the incident.\n\nThe [FBI attributed the theft to North Korea’s TraderTraitor hacking operation](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack), warning that stolen assets were being converted into Ether and could be laundered through decentralized finance platforms.\n\nNorth Korea has denied involvement in the attack.\n\n**Disclosure:** This article was edited by John Chen. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).\n\n## More in Finance\n\n[See all](https://cryptobriefing.com/finance/)", "url": "https://wpnews.pro/news/binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack", "canonical_source": "https://cryptobriefing.com/binance-attacker-compromised-computer-ai-tool/", "published_at": "2026-11-03 14:55:32+00:00", "updated_at": "2026-11-03 15:24:50.163215+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Binance", "Ethereum", "EIP-7702", "FBI", "TraderTraitor", "North Korea", "XRP", "Solana"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack", "markdown": "https://wpnews.pro/news/binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack.md", "text": "https://wpnews.pro/news/binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack.txt", "jsonld": "https://wpnews.pro/news/binance-reveals-fake-job-interview-and-compromised-ai-tool-behind-6-34b-hack.jsonld"}}