Binance Says Fake Recruitment Led Attackers to Wallet Systems

Binance said a fake recruitment approach gave attackers a path from an engineer’s work computer to wallet-signing systems in an incident that affected about $6.34 billion in digital assets.

Binance said a person posing as a project director approached an engineer in September through a legitimate job-search site and sent a malicious coding task to the engineer’s work computer. Binance said the compromised workstation and an internal AI tool gave attackers access to two colleagues’ computers on Oct. 20.

Binance said stolen credentials were used on Oct. 29 to set up a container and execute a malicious script. The exchange estimated that $2.85 billion had been frozen or intercepted as of Nov. 3, while noting the figure could change with reconciliation and market prices.

Binance said the final unauthorized transfer was 2,961.9 Ether (ETH), confirmed on-chain at 7:56 p.m. ET Oct. 29 (23:56 UTC). The exchange removed the EIP-7702 delegation at 8:10 p.m. ET that day (00:10 UTC Oct. 30).

The exchange said suspending withdrawals and shutting down hot wallet services did not revoke existing on-chain authorizations, which let attackers move assets outside its usual withdrawal system.