Binance Confirms Fake Job Lure Enabled $6.34B Security Breach
Key Summary
Binance revealed that a fake job assignment deployed malware onto employee laptops, allowing attackers to access internal wallet signing systems and compromise approximately $6.34B in assets during the October 29 exploit.
Key Bullets
- Malicious software disguised as a coding test bypassed endpoint security on an engineer laptop back in September.
- Attackers used stolen internal credentials to compromise wallet infrastructure and bypass standard withdrawal suspensions via EIP-7702.
- Binance reported that $2.85B in stolen assets has been frozen or intercepted as reconciliation work continues.
- Independent security firms will audit the incident report while Binance rebuilds affected internal systems.
Fake Recruitment Test Breaches Infrastructure
Binance disclosed Monday that a malicious software payload delivered through a fake job-search recruitment task allowed attackers to compromise employee workstations prior to the October 29 hack. According to incident disclosures published by the exchange, a software engineer downloaded a fraudulent coding assignment in September after completing interviews with a fictitious company. The setup package contained executable code that escaped local endpoint detection tools.
That initial workstation compromise paved the way for lateral movement across internal networks. Public security updates from the exchange confirm that attackers used internal AI tools on October 20 to access two additional employee computers. They extracted deployment credentials tied directly to the core wallet infrastructure.
Wallet Signing Service Compromise Unfolds
Stolen deployment keys granted attackers direct access to Binance internal wallet-signing services on October 29, enabling unauthorized transfers that bypassed standard withdrawal protocols. On-chain data and exchange disclosures show the exploit affected approximately $6.34B in digital assets. Attackers utilized Ethereum delegation features under EIP-7702 to keep funds moving even after the CEX suspended normal withdrawal operations.
Emergency controls failed to halt transfers immediately because the delegated permissions required custom revocation procedures. Engineers deployed a targeted fix at 00:10 UTC on October 30 to clear the lingering delegation permissions. Liquidity remained constrained during the manual intervention.
Exchange Recovers Funds and Rebuilds Systems
Binance reported that approximately $2.85B of the exposed capital has been successfully frozen or intercepted across various platforms. Corporate statements indicate that the exchange holds sufficient reserves to cover any unrecovered losses and continues purchasing outstanding affected assets from the open market. External security auditors will review the finalized incident reports.
Remediation efforts involved entirely rebuilding the compromised wallet infrastructure and replacing all impacted internal hardware credentials. Traders monitored order books closely as withdrawal queues normalized. The incident closed with significant balance sheet adjustments.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.