$6.3 Billion Binance Hack Began with a Fake Job Interview: Exchange Reveals Details of Largest Crypto Attack
The largest hack in cryptocurrency history, involving $6.3 billion, was the result of a months-long operation.
Here is how the attack by North Korean hackers unfolded:
➡️ Fake Job Interview (September): Hackers contacted a Binance software engineer, posing as recruiters. After two rounds of video interviews, they asked him to download a "test assignment." It contained a "zero-day" exploit—malware that went undetected by antivirus software.
➡️ Counterfeit AI Tool (June): Another developer installed a malicious package via the Homebrew package manager while searching for artificial intelligence tools. Although the device was replaced, the hackers managed to retain access.
➡️ System Infiltration (October 20–29): The attackers used the compromised engineering workstation and an internal AI tool to gain access to the computers of two specialists responsible for "hot wallets." On October 29, they utilized stolen credentials to execute a malicious script.
➡️ Funds began to be drained at 20:05 UTC, leveraging the Ethereum EIP-7702 standard to gain authorization to perform operations on the hot wallets. Thanks to a multi-party computation (MPC) system, the attackers were successfully stopped after a few hours.
#HackerAlert #BinanceHack2026
$BNB $ETH $BTC
The largest hack in cryptocurrency history, involving $6.3 billion, was the result of a months-long operation.
Here is how the attack by North Korean hackers unfolded:
➡️ Fake Job Interview (September): Hackers contacted a Binance software engineer, posing as recruiters. After two rounds of video interviews, they asked him to download a "test assignment." It contained a "zero-day" exploit—malware that went undetected by antivirus software.
➡️ Counterfeit AI Tool (June): Another developer installed a malicious package via the Homebrew package manager while searching for artificial intelligence tools. Although the device was replaced, the hackers managed to retain access.
➡️ System Infiltration (October 20–29): The attackers used the compromised engineering workstation and an internal AI tool to gain access to the computers of two specialists responsible for "hot wallets." On October 29, they utilized stolen credentials to execute a malicious script.
➡️ Funds began to be drained at 20:05 UTC, leveraging the Ethereum EIP-7702 standard to gain authorization to perform operations on the hot wallets. Thanks to a multi-party computation (MPC) system, the attackers were successfully stopped after a few hours.
#HackerAlert #BinanceHack2026
$BNB $ETH $BTC
