A fake job interview and a single authorization on Ethereum helped thieves drain about $6.3 billion from Binance in minutes.
Story Snapshot
- Binance says a recruiter scam and hidden malware led to unauthorized withdrawals across ten blockchains.
- On-chain analysis points to an Ethereum EIP-7702 authorization that let attacker code empty a hot wallet.
- Roughly $6.3 billion moved fast, with most transfers within about 20 minutes, analysts reported.
- Binance says it replenished about 98% of affected assets and rebuilt key systems after the breach.
Binance’s Preliminary Findings on How the Breach Began
Binance reported that attackers posed as recruiters, interviewed a company engineer, and sent a coding test that hid malware. Executives said that malware paved the way to access an internal service and trigger unauthorized withdrawals. The company’s preliminary note also said the path may have included a compromised DevOps engineer laptop and access to a service container that could submit withdrawals. Binance labeled this account as an early readout while the internal investigation continued.
Co-chief executive Richard Teng said Binance restored about 98% of the impacted assets and is still working on thinly traded tokens. He said the company rebuilt the affected wallet system and an internal artificial intelligence tool, replaced devices, revoked related credentials, and increased security scans on employee machines. Those steps match a response to an internal compromise. The company also communicated that its user withdrawals had stabilized after the incident in the days that followed.
On-Chain Mechanism: EIP-7702 Authorization and Wallet Draining
Security teams tracking the theft pointed to a sequence of authorizations created under Ethereum’s EIP-7702 feature. Reports said attackers prepared many pre-signed permissions and one matched the wallet’s transaction order, delegating the Binance wallet’s authority to attacker-controlled contract code. That code then drained the wallet. Analysts stressed this showed how an existing protocol feature could be abused once attackers gained the needed signing or authorization path.
Technical write-ups added that EIP-7702 itself did not cause the theft, but it likely made the drain faster once the attackers had the right authorization. This view aligns with the idea that the core failure involved compromised workflow access or signing, and the on-chain permission sped up the loss. The effect was seen most clearly on Ethereum, while the broader theft also moved value across other major networks.
Scale, Speed, and Cross-Chain Movement of Funds
Independent blockchain reporting estimated that about $6.36 billion left Binance-linked wallets across ten blockchains. Most of the value moved within about 20 minutes, showing a high level of preparation and automated execution. The figure varies slightly by report due to price swings during the event window, but outlets repeatedly describe a roughly $6.3 billion loss, making it one of the largest known digital asset thefts.
FBI attributes the record Binance heist to North Korea’s TraderTraitor: $6.43 billion taken across 11 blockchains — The FBI, with the Secret Service and IRS Criminal Investigation, now formally…#CyberSecurity #InfoSechttps://t.co/2NNQJ2fSXR
— Jim Nitterauer (@JNitterauer) November 3, 2026
Some coverage noted similarities with past social-engineering campaigns that targeted crypto employees. A joint advisory from the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Treasury Department detailed recruiter-themed lures and malware used since 2020 against developers and operations staff in this sector. That pattern helps explain why a fake interview could be an effective first step against a large exchange.
Why This Matters for Everyday Investors and Institutions
This case shows how one well-placed device compromise can reach critical wallet systems in a centralized platform. It also shows how speed and automation can move billions before defenses can react. For customers, the difference between “recovered,” “replenished,” and “frozen” matters. Binance’s 98% figure came from its own leadership. That is common after major hacks, but outside attestation and transparent chain maps help the public gauge what is truly restored versus merely replaced.
Policy and Security Takeaways Across the Political Spectrum
Lawmakers and regulators often focus on bank-grade controls, but crypto platforms blend software, custody, and finance in one stack. That creates single points of failure that criminals can hit through people, not just code. Conservatives who worry about weak security and waste see preventable lapses. Liberals who fear growing inequality see a system where insiders and elites rebound faster than small savers. Both sides can agree that strong controls and clear public accounting are overdue.
What to Watch Next
Watch for a fuller incident timeline, including when the fake interview began, how the malware moved, and how authorization paths were abused. Look for independent reviews that compare internal logs with the EIP-7702 transactions and for a chain-by-chain map of amounts, timestamps, and current status. Also track any public statements from the FBI or Treasury on attacker identity, since some reports mention hallmarks of known state-linked groups without formal attribution in the record.
Sources:
insiderpaper.com, securityweek.com, perplexity.ai, lcx.com, panaprium.com
