Binance details fake recruitment tactics behind $6.34 billion attack
Key points
- Binance disclosed that hackers used fake recruitment interviews and malicious software to compromise employee computers before its 29 October security incident.
- The attack affected approximately $6.34 billion in digital assets, with $2.85 billion frozen or intercepted.
- Investigators identified compromised credentials, internal AI tools and wallet-signing access as key parts of the attack.
Binance has revealed how hackers used fake recruitment interviews to compromise employee computers before its $6.34 billion security incident.
The attackers exploited compromised credentials and internal systems to access wallet-signing infrastructure on 29 October 2026.
“This should not have happened,” Binance said in its initial security incident report.
The attackers distributed malicious software through a fake job assignment, gaining access to an employee's work computer.
They later exploited an internal AI tool to reach other employees and obtain access to deployment credentials.
The breach enabled unauthorised transfers across several networks, including 233.46 million XRP, 970,500 SOL, 44.2 million Optimism (OP) and 18,270 BTC.
Binance froze or intercepted approximately $2.85 billion in assets and replenished 98% of affected token holdings by 31 October.
The exchange is commissioning an independent cybersecurity review and expanding AI-based detection to strengthen its wallet security systems.
Frequently asked questions
More from Crypto
SEC staff grants Canton Coin limited minting relief
SpaceX objects to tokenised shares on OKXICE
Moscow Exchange launches Bitcoin and Ether trading in December
Capital Markets Alliance challenges CFTC stock perps approval
Justin Sun seeks sanctions against World Liberty Financial
Prediction markets shift beyond election trading
