- Binance says the theft of about $6.34bn began with a fake job interview aimed at one of its engineers.
- Its 3 November security report describes a campaign built over months, ending at the systems that sign hot-wallet transactions.
- The exchange also says it blocked 57 suspected North Korea-linked attempts on its staff and systems this year. This one got through.
Binance says it stopped 57 North Korea-linked attempts on its people and systems during 2026. Number 58 worked. The exchange’s account of how roughly $6.34bn left its wallets starts not with a line of code but with a job offer that did not exist.
The way in was a person, not a flaw in any . That matters for two reasons. If you hold coins on any exchange, what protects them is that company’s internal security, which no customer can inspect or audit from outside. And the specific trick used here, a fake recruiter and a staged interview, is aimed at individual developers and crypto workers as often as it is at large firms. If you work in or near this industry, the approach is eventually coming to your inbox.
What the exchange has said
According to the security report published on 3 November, attackers posing as recruiters ran a hiring process that was entirely fabricated: invented identities, staged interview calls, the whole shape of a real job application. One Binance engineer was compromised that way. CoinDesk reports the exchange describing the operation as “built over many months” rather than a single intrusion.
From there, CryptoSlate’s account of the same report says the attackers worked through a compromised employee computer and an internal artificial intelligence tool on 20 October, before reaching the infrastructure that signs transactions out of the exchange’s hot wallets. Hot wallets are the pots an exchange keeps connected to the internet so customers can withdraw on demand, as opposed to the that stays offline.
One note on sourcing, and then we will leave it alone. We have not seen the report itself, only the write-ups by CoinDesk and CryptoSlate. A company’s description of its own breach is also an interested source: it sets the timeline, decides what counts as the starting point, and chooses which details are technical enough to leave out.
What the lure looks like
The pattern has been documented across the industry for years and barely changes. An approach arrives on LinkedIn, Telegram or by email, usually offering a well-paid remote role at a company with a plausible but thin web presence. There are several interview stages, which is what makes it feel legitimate. Then comes the payload: a take-home coding exercise hosted in a private repository, or a video call that fails to connect and prompts you to install a driver, a patch or a meeting client to fix it.
Running the code, or installing the fix, is the moment the machine is lost. Everything before it exists to make that step feel like a normal part of applying for a job.
For anyone working with keys, signing tools or production access, the practical defence is unglamorous. Treat any unsolicited technical task as hostile until proven otherwise, run it on hardware that touches nothing else, and verify the recruiter through the company’s own published contacts rather than the ones in the message.
The EIP-7702 part
The reporting says the final stage ran through EIP-7702, a feature added to Ethereum in the Pectra upgrade in May 2025. In plain terms, it lets an ordinary wallet address temporarily borrow the behaviour of a by signing an authorisation. It was designed to make wallets more capable: batching several actions into one transaction, letting someone else pay the , adding spending limits.
The mechanism does what it was built to do. It needs a valid signature from the account, which is why control of the signing infrastructure is the thing that actually mattered here, and why calling this an Ethereum vulnerability would be wrong. Once an attacker can produce authorised signatures, delegation simply makes draining an account faster and tidier than sending transactions one at a time.
For scale, the largest exchange theft on record before this period was the roughly $1.5bn taken from Bybit in February 2025, also attributed by investigators to North Korea-linked operators. The figure Binance has disclosed is several times that.
What the report does not answer
Neither write-up mentions insurance, so whether any portion of the loss is covered is unknown. Nor is it clear how long the attackers held access before 20 October, what the internal AI tool was actually used for, how the 57 blocked attempts were counted, or how customer balances have been made whole. Attribution to North Korea is reported rather than independently confirmed in anything we have seen.
What to watch
Whether Binance publishes a full technical post-mortem with addresses. That is what would let analytics firms and other exchanges trace and freeze funds, and it is the difference between a disclosure and an explanation. Watch, too, for whether any government agency formally attributes the theft, and whether other exchanges now admit to the same recruitment approaches landing in their own hiring pipelines. One firm being targeted this way is an incident. A dozen saying so would reframe the whole of the last year.
If this has you reconsidering where your coins sit, our guide to self-custody sets out what moving them off an exchange does and does not protect you from.