# Binance Details Fake-Recruiting Attack in $6.3 Billion Incident

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/48612
Published: 2026-11-04T15:49:52.000Z
Updated: 2026-11-04T15:49:52.000Z
Section: Technology

> Attackers used a fake coding test to target an engineer. Binance said $2.85 billion was frozen or intercepted and it would cover losses without passing them to customers.

Binance said its investigation found attackers used a fake recruiting process to compromise an engineer and reach wallet infrastructure in an incident involving about $6.3 billion in digital assets.

The attack began in June, when an engineer installed a tampered software package while setting up an AI development tool. In September, attackers posed as corporate recruiters and sent another engineer a malicious file disguised as a coding test, evading Binance’s security controls.

On Oct. 20, attackers used compromised machines and Binance’s internal AI tools to reach two more engineers and obtain deployment credentials. Nine days later, they placed malware in the exchange’s wallet infrastructure and accessed its wallet-signing service, which authorizes transactions. That access let them bypass normal withdrawal procedures.

Binance said $2.85 billion of the assets had been frozen or intercepted and that it would cover losses without passing them to customers. The company said it had replenished 98% of affected token balances by Oct. 31. Binance co-CEO Richard Teng characterized the operation as a months-long, multistage attack rather than a single system intrusion.

Binance’s account also described the attackers’ use of Ethereum’s EIP-7702 feature, which lets wallets delegate some transaction permissions to smart contracts. Some unauthorized transfers continued after Binance paused withdrawals.