Binance Traces $6.3 Billion Theft to a Fake Job Interview as Its CFO Steps Down

Binance says the attackers who stole about $6.34 billion on October 29 reached its wallet-signing systems through a campaign that began with a tampered software install in June and a fake job interview in September, compromising three engineers' computers. The exchange published its initial incident report on November 3 and says the attack was not a single breach or a simple phishing incident. This report fills a gap noted in our earlier coverage, when Binance said a compromised laptop was involved but gave no technical detail.

On Saturday, co-CEO Yi He announced that chief financial officer Kaiser Ng is leaving and will be replaced by Justin Yek, a former finance executive at Airwallex, Bloomberg reported. Yi He said Ng is leaving to pursue a new venture and that a transition plan had been in place for six months, before the theft.

The report lays out a multi-stage campaign which in summary says:

• In June, an engineer downloaded a tampered version of a software tool, which exposed some of his team.
• In September, another engineer was approached on a job-hunting site by someone posing as a recruiter. After fake interviews, he was told to download a “test assignment” that secretly installed spyware.
• Using that foothold, the attackers took over a third engineer's computer. The first engineer's computer held the access needed to run the exchange’s wallet systems.
• On October 29, they used that access to send out the money, mostly in about four minutes.

The attacker then used the signing service to abuse Ethereum's EIP-7702 mechanism, giving a contract it controlled partial execution rights over a hot wallet. Binance says the attackers submitted 50 signing transactions to manipulate the account nonce and set up malicious delegations that operated independently of its withdrawal infrastructure, so suspending withdrawals could not stop them. Because the wallet used multi-party computation, no single private key could revoke the delegations, and the team had to build a specialized procedure.

Binance says about $2.85 billion in digital assets has been frozen or intercepted, subject to reconciliation and market price volatility, a figure Elliptic also counted. As of November 3, about $3.18 billion remained in theft-linked addresses. Elliptic, which puts the total theft at $6.43 billion, counted about $3.11 billion still in linked addresses, mainly in bitcoin and ether, Analytics Insight reported.

The attackers have started moving the stolen funds. By 08:45 UTC on Friday, Elliptic counted about 1,650 BTC, worth roughly $124 million, in new addresses funded from the theft, almost double the previous day's figure. XRP tokens were moving fastest: about 42 million XRP, worth about $50 million, had been swapped mostly through THORChain, with about 192 million XRP, around $227 million, still unspent. Blockhead covered the debate over that protocol's role in October in THORChain's Critics Live in Delusional Glass Houses.

98% of the impacted token assets had been replenished and are verifiable on its Proof of Reserves page, and it is buying the outstanding, more illiquid assets.

Binance says the entry points used in the attack are closed and the affected wallet system and internal AI tool have been rebuilt, with affected devices replaced, related credentials and tokens decommissioned and security scans completed across all employee devices.

It has added device controls and wallet-service risk controls and expanded AI-based behavioural anomaly detection. It plans an independent third-party review, more spending on AI security and developer-environment protection, and a security research fund with AI companies and security firms. The report says some technical details will stay confidential so attackers cannot use them, and that its findings remain subject to further independent review.

The attack method has surfaced again at a smaller scale. SignalPlus, a Hong Kong-based derivatives tools provider, said an engineer's computer was compromised through a fake Microsoft Teams invitation sent from a hijacked vendor contact, with losses under $82,000. Binance and Deribit revoked all API keys linked to SignalPlus on November 5 as a precaution.

The North Korean-linked group the FBI blames has a long record against exchanges. Blockhead covered the earlier record theft when Bybit lost $1.5 billion and in August when Bybit sued North Korea and won an asset freeze.