Binance Says Fake Hiring and Compromised AI Tool Led to $6.3 Billion Theft

Binance said a months-long attack using fake hiring and a compromised internal AI tool led to $6.3 billion in stolen assets from the exchange’s wallet infrastructure.

The operation also involved tampered software packages, malicious coding tasks sent by people posing as recruiters and compromised employee computers. Binance said attackers used the access to obtain deployment credentials and penetrate wallet systems.

On Oct. 29, attackers placed malware in wallet infrastructure and accessed Binance’s internal wallet-signing service, bypassing the exchange’s routine withdrawal process, Binance said. They used Ethereum’s EIP-7702 mechanism to make unauthorized transfers even after the exchange suspended withdrawals.

Binance said it froze or intercepted $2.85 billion in assets and would absorb the loss instead of passing it to customers. By Oct. 31, the exchange had replenished 98% of affected token assets.

The breach connected recruiting and software channels with access to a service used for wallet signing inside Binance’s exchange infrastructure.