Binance says its $6.34 billion theft began with a fake job interview and a malware-laced coding test sent to an engineer in September

Binance published its initial findings on the October 29 theft on Tuesday, and they trace the attack to a fake job offer. In September, a Binance software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director, the exchange said. After interviews with a supposed HR representative and a supposed CEO, the engineer was asked to download a coding assignment that installed a zero-day malware variant the company's endpoint tools did not detect.

It was not the first attempt. In June, an engineer in Binance's Wallet DevOps team installed a tampered Homebrew package while looking for an AI coding tool; Binance replaced the device and rotated credentials. By then, Fortune reports, the attackers had already learned about that engineer's role and about others who managed company wallets.

On October 20, Binance says, the attacker used the infected computer and an internal AI tool to gain control of two more wallet engineers' machines and found a container deployment token. On October 29 it used that token to launch the attack. Between 20:05 and 20:09 UTC five hot wallets sent 233.46 million XRP to an attacker-controlled address, and other hot wallets sent about 970,500 SOL, 44.2 million OP and 18,270 BTC; the last transfer, about 2,962 ETH, was finalised at 23:56 UTC. The attacker had used Ethereum's EIP-7702 mechanism to give its own contract partial execution rights over a hot wallet, and because the wallet used multi-party computation, no single key could revoke them at once, Binance said. It cleared the malicious delegation at 00:10 UTC on October 30.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users," Binance wrote. It says about $2.85 billion is frozen or intercepted, that it had replenished 98% of the affected tokens by October 31, and that it detected and prevented 57 suspected North Korea-linked cyber threat cases this year. The FBI has attributed the theft to North Korea, which denies it.