Binance details how fake job interview preceded $6.34 billion breach
Binance’s initial report describes a fake job interview, compromised devices and misuse of its wallet signing service. Withdrawals for more assets are reopening in stages.
Binance says attackers used a fake recruitment process and compromised internal systems before the October 29 security incident that affected about $6.34 billion in digital assets. Its November 3 report is an initial account; the investigation continues and Binance says independent security specialists will review its findings.
From a job interview to the signing service
According to Binance, an engineer was contacted through a job platform in September and downloaded a malicious coding assignment to a work computer during a second interview. On October 20, the attackers used that computer and an internal AI tool to compromise two other engineers. Binance says stolen credentials were then used on October 29 to deploy a container and reach a wallet signing service. These are the company’s findings, not an independently completed forensic review.
Why pausing withdrawals was not enough
Binance says attackers used Ethereum’s EIP-7702 authorization mechanism to give an attacker-controlled contract partial execution rights over a hot wallet. The resulting on-chain authorization operated outside the normal withdrawal system, so suspending withdrawals did not automatically revoke it. Binance says it cleared the delegation at 00:10 UTC on October 30. Security research group GCSA, which examined selected Ethereum transactions, cautions that a valid signature alone cannot establish whether a private key was stolen or which internal system initiated a request; its work was not a full cross-chain audit.
Replenishment figures need clarification
Binance says about $2.85 billion in assets had been frozen or intercepted, subject to reconciliation and price changes. Frozen assets are not necessarily recovered. Its November 3 report says 98% of affected token assets had been replenished as of October 31, while its November 2 update put the covered amount at approximately 95%. The dates or measurement basis have not been reconciled, so neither figure should be presented as an independently verified recovery rate.
More withdrawals are reopening
Binance said its next phase would begin at 04:00 UTC on November 3, with network-asset pairs restored progressively after security checks. A later official post confirmed selected assets on Ethereum and Solana had reopened; it did not confirm completion of the entire planned list. Availability and processing times can differ, so users should check the specific asset and network in the official withdrawal page. Binance.US is a separately operated platform.
Sources
YOUR BINANCE REFERRAL CODE
- 20% Spot Trading Rebate
- 20% Futures Trading Rebate
- Up to $100 Sign Up Rewards
Available rewards are confirmed during registration.
We may earn a commission when you use this link, at no extra cost to you. Terms and regional restrictions apply.