Binance Post-Mortem Blames Fake Job Interview for $6.3B Wallet Hack

A Phony Interview, a Tampered Installer

Binance published its initial post-mortem on November 3 for the October 29 breach that drained roughly $6.3 billion from its hot wallets. In the exchange's incident report, the company describes an intrusion that began with a fake job interview and unfolded in stages across several months before any funds moved. Co-CEO Richard Teng characterized it as a prolonged, organized operation. The FBI had already attributed the theft on October 31 to TraderTraitor, a North Korea-linked hacking unit, and the report now supplies the first full technical account of how the largest exchange breach on record was assembled.

The report traces the operation back to June, when a wallet DevOps engineer downloaded a tampered Homebrew installer while setting up an AI coding tool. Binance's security team detected the anomaly, replaced the device and rotated credentials, but the engineer's role and the identities of wallet-infrastructure colleagues were already exposed. In September, a software engineer whose profile listed his Binance employment was contacted on a legitimate job platform by an attacker posing as a project director. After a video call with a fake recruiter and a second round with a supposed CEO, he was told to download a coding task onto his work machine. The file carried malware that swapped the development tool pyenv for a malicious version, evading endpoint detection entirely.

On October 20, the attackers used the compromised machine and an internal AI tool to seize control of two wallet engineers' computers, where they found container deployment credentials. On October 29 they deployed a service container with the stolen credentials and ran a malicious script against Binance's wallet-signing system. Five hot wallets moved 233.46 million XRP within four minutes, then roughly 970,000 SOL, 44.2 million OP and 18,270 Bitcoin. The attackers sent 50 transactions through the signing service, manipulating account nonces and abusing EIP-7702, Ethereum's mechanism for delegating account execution, to grant a malicious smart contract partial control of a hot wallet. Pausing withdrawals could not stop the outflow: the final unauthorized transfer, 2,961.9 ETH, was already broadcast and confirmed nearly four hours after the first movement, and Binance only cleared the delegation at 00:10 UTC on October 30 by sending a new authorization pointed at the zero address.

$2.85 Billion Frozen, 98% Restored

Binance says about $2.85 billion was frozen or intercepted, and that as of October 31 roughly 98% of the affected token assets had been restocked from its own funds, with the remaining less-liquid assets still being bought back. Losses are being absorbed by the exchange rather than passed to users. In a post on X, Richard Teng confirmed withdrawals have largely resumed and credited the freezes to cooperation with law enforcement, stablecoin issuers and on-chain analytics firms. The report lists completed remediation: affected wallet systems and internal AI tooling rebuilt in a new environment, devices replaced, engineer credentials revoked and a security scan across all staff equipment. An independent third-party audit and a security research fund are the next steps.

@_RichardTeng · X post

Richard Teng confirmed withdrawals have largely resumed.

View on X

Kim Yo Jong Denies Involvement

North Korea has formally rejected the attribution. In a statement carried by state media KCNA on Tuesday, Kim Yo Jong, the leader's sister and a senior ruling-party official, dismissed the FBI's accusation as “nonsense rhetoric” and called it a political provocation aimed at portraying the country as a “cyber-crime state.” She suggested, without evidence, that investigating who could access the recovered funds might reveal the real mastermind, and repeated her denial of North Korean involvement in the February 2025 Bybit hack. The United States has not responded to her statement. Blockchain investigators, including TRM Labs, Chainalysis and ZachXBT, maintain that on-chain and technical evidence points to the TraderTraitor group.

Laundering Trail and Market Fallout

Most of the stolen funds remain in motion rather than recovered. Elliptic estimates about $3.18 billion is still sitting in theft-linked addresses, mostly in Bitcoin and Ether, after tracing roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions in three and a half days. TRM Labs documented laundering through self-minted tokens and chained bridges, while Chainalysis observed addresses funded with exactly 1 TRX, a signature of automated transfers. ZachXBT has flagged overlaps with the Bitget hack, where some stolen funds merged after passing through THORChain. Markets dipped as much as 5.0% for Bitcoin and 6.1% for Ether before stabilizing, and net outflows from the exchange reached $4.72 billion after withdrawals resumed, though $2.7 billion later flowed back in.

EIP-7702 Is the Structural Risk

The post-mortem's core lesson is that this was not a key leak but a permissions failure. The attackers never obtained a private key; they obtained a delegated execution right, and EIP-7702 wrote it on-chain where no withdrawal pause could reach it. That distinction matters for anyone weighing a custodial crypto wallet against self-custody: a hardware wallet or cold wallet removes exchange counterparty risk entirely, at the cost of shifting operational burden to the user. Binance says it blocked 57 suspected North Korea-linked attacks in 2026 before this one got through, a measure of the pressure on exchange defenses. CZ, the exchange's founder, has warned that AI-driven hacks will multiply and the industry must counter AI attackers with AI, a view the report's planned security investments appear to endorse.