Binance Says Fake Hiring Scheme Enabled $6.34 Billion in Unauthorized Transfers

Binance says attackers transferred about $6.34 billion in digital assets through its internal wallet-signing service after a fake recruiting approach compromised an engineer’s work computer, exposing a weakness in onchain authorizations during the response.

The incident occurred Oct. 30, when transfers bypassed the exchange’s normal withdrawal process. Binance co-CEO Richard Teng said about $2.85 billion had been frozen or intercepted by the time of the discussion, a figure included in Binance’s earlier update on the funds.

Binance Chief Security Officer Jimmy Su said a person posing as a project lead contacted a software engineer through a recruiting platform in September. The engineer was then asked to run a coding assignment on a work computer. Su said the repository contained malicious software that ran during setup, and Binance believes it included a zero-day that the company’s endpoint security product did not detect.

Su said attackers had already created authorizations on the blockchain, so pausing withdrawals did not cancel them. The affected hot wallet used multi-party computation (MPC), and there was no single private key that could immediately revoke the authorizations. The team had to design and execute a revocation procedure, a process that took several hours to stop further outflows.

Teng said the affected wallets and asset positions belonged to Binance, not customers, and that the exchange would cover the losses. Binance had replenished about 98% of the affected tokens by the time of the discussion. Teng said the remaining assets had lower liquidity and would take longer to replace.

Binance completed emergency fixes by Nov. 3, including rebuilding affected wallet systems and internal AI tools in a new environment, replacing an employee’s device and revoking credentials. The exchange plans to bring in outside security experts to review its investigation and recommend changes. It also plans to strengthen system isolation and AI-based threat detection.

Co-CEO He Yi said she supported sharing technical details despite objections from some senior managers and the legal team, arguing that the information could help other platforms improve security. Binance also plans to establish a security research fund and work with AI companies and cybersecurity groups.