🚨 Fake job interviews behind the Binance hack… Here’s the full story of the cyberattack that took place on October 29, 2026.
Binance’s preliminary investigation revealed that the hack was a sophisticated cyber operation planned in several stages, targeting employees inside the platform to gain access to hot wallet systems.
It began with fake job interviews, which were used to deceive an employee into downloading malicious files and software onto their work device, giving the attackers access to internal data and permissions.
The hackers then exploited these permissions to access the hot wallet transaction-signing systems and carry out unauthorized transfers across several networks, including XRP, Bitcoin, Solana, and Ethereum.
The attacks did not stop as soon as withdrawals were suspended. The attackers exploited the EIP-7702 delegation mechanism on the Ethereum network, allowing them to continue moving some assets independently of the usual withdrawal system.
According to Binance, the value of the affected assets was approximately $6.34 billion, while the platform and its partners managed to freeze or intercept assets worth $2.85 billion.
The investigation pointed to North Korea’s responsibility for the attack, based on the latest information released by the U.S. Federal Bureau of Investigation (FBI).
Binance’s preliminary investigation revealed that the hack was a sophisticated cyber operation planned in several stages, targeting employees inside the platform to gain access to hot wallet systems.
It began with fake job interviews, which were used to deceive an employee into downloading malicious files and software onto their work device, giving the attackers access to internal data and permissions.
The hackers then exploited these permissions to access the hot wallet transaction-signing systems and carry out unauthorized transfers across several networks, including XRP, Bitcoin, Solana, and Ethereum.
The attacks did not stop as soon as withdrawals were suspended. The attackers exploited the EIP-7702 delegation mechanism on the Ethereum network, allowing them to continue moving some assets independently of the usual withdrawal system.
According to Binance, the value of the affected assets was approximately $6.34 billion, while the platform and its partners managed to freeze or intercept assets worth $2.85 billion.
The investigation pointed to North Korea’s responsibility for the attack, based on the latest information released by the U.S. Federal Bureau of Investigation (FBI).
