Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Binance says the largest crypto theft to date unfolded over months: a developer downloaded a tampered installer in June, apparently spread by a malicious Google ad, exposing details about its engineers and how they work.
- Fake job interviews were used in September to target another engineer through repeated calls, multiple interview rounds and shared social media pages, before prompting a fake assignment that was actually malware — a vector security researchers had warned about for years.
- TraderTraitor, the North Korean unit the FBI identified, used Binance's own internal AI tool by October 20 to take control of wallets tied to the June-compromised engineer and a third employee, then logged into that third employee's computer on October 29 to launch the attack.
- pyenv — Binance's security team detected the first malware installation in June and replaced the worker's device, but missed a second attack that deleted the pyenv executable and substituted a malicious version; the 0-day evaded endpoint protection tools and the attacker removed traces.
- EIP-7702 — Binance says it could not stop transactions occurring nearly two hours after the first unauthorized transfers because the hot wallet used Multi-Party Computation, leaving no single private key to revoke the malicious authorizations.
- Richard Teng says no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted and 98% of impacted tokens replenished, the remaining 2% in progress; Binance separately says it has prevented 57 suspected North Korea-linked cyber threat cases.
- Binance's internal AI tool — the postmortem offers little detail on how attackers used the tool or why it let them take control of wallets, leaving the mechanism that unlocked the heist largely unexplained.
Why it matters: Binance absorbed a record $6.3 billion attack — $2.85 billion of it frozen or intercepted, 98% of tokens replenished, and no user out of pocket — yet its own team caught the June infection and missed the pyenv 0-day. The attackers' use of Binance's internal AI tool made the company's own tooling the lever against it.
Ask SkimNews
