Fake Job Interview Helped Hackers Steal $6.3 Billion From Binance
Summary
Binance described how a fake job interview led to malware on an engineer’s work computer before the Oct. 29 theft. The exchange said it and partners froze or intercepted $2.85 billion; Elliptic reported about $3.24 billion remained in linked addresses.
Key points
- Hackers posing as recruiters reportedly persuaded a Binance software engineer to install a malicious version of a developer tool on his work computer.
- Binance said its endpoint protection did not detect the malware; the article reports that the attackers later used the infected machine and an internal AI tool to access other employees’ computers.
- Using a stolen access token, the attackers reportedly abused Binance’s internal wallet signing service to authorize transfers outside the normal withdrawal process.
- Binance suspended withdrawals and worked with partners to freeze funds; the exchange said $2.85 billion had been frozen or intercepted and that it replenished 98% of affected tokens by Oct. 31.
- Elliptic reported that about $3.24 billion remained in addresses tied to the theft as of Monday. TRM Labs and Elliptic described laundering methods that included cross-chain bridges and CoinJoins.
- The FBI blamed TraderTraitor for the theft, according to the article; Binance rebuilt the wallet system and AI tool.
Article Details
- Victim Organization
- Binance
- Incident Type
- Malware-enabled compromise followed by unauthorized transfers from Binance wallets
- Operational Impact
- Binance suspended withdrawals while responding. The attackers stole approximately $6.3 billion in cryptocurrency. Binance said it replenished 98% of the affected tokens by Oct. 31 and rebuilt the wallet system and internal AI tool.
- Claim Status
- confirmed