Crypto security
How Did a Fake Job Interview Lead to Binance’s $6.34 Billion Theft?
Binance says a fake recruitment process helped attackers reach its wallet infrastructure before the October 29 theft of approximately $6.34 billion. Its November 3 preliminary report describes compromised employee devices and stolen permissions. Blockchain investigator TRM Labs separately estimates $6.36 billion across ten networks, with most funds moved in about 20 minutes.
A coding assignment opened the door
According to Binance, an engineer downloaded a malicious coding assignment during interviews for a fictitious employer. Attackers later used the compromised computer and an internal AI tool to reach colleagues’ devices, obtain deployment credentials, and access wallet-signing operations. The precise role of the AI tool has not been fully disclosed.
Transactions outlasted the withdrawal pause
TRM’s on-chain analysis points to compromised signing infrastructure. It reports that attackers prepared Ethereum EIP-7702 authorizations to delegate wallet execution to a contract they controlled, alongside transfers on other networks. Binance says the final unauthorized transfer finalized at 23:56 UTC, hours after the initial burst; pausing withdrawals did not invalidate on-chain permissions.
Recovery figures need context
Binance reported approximately $2.85 billion frozen or intercepted as of November 3. It also said 98% of affected token assets had been replenished as of October 31. Replenishment covers the shortfall; it does not mean those stolen funds were recovered. Its investigation remains preliminary.
The case highlights a chain of employee compromise, permission abuse, and unauthorized signing rather than evidence that Bitcoin or Ethereum themselves were breached.
Where CrossClassify fits
For crypto platforms, the relevant lesson is to evaluate the session behind a sensitive account action. CrossClassify combines behavior, device, and location signals to identify suspicious account activity. On an integrated web or mobile application, that context can inform the platform’s decisions about review or additional verification before allowing an action.
Explore how device, behavior, and location signals help crypto teams assess suspicious exchange-account activity.
See why valid credentials still need session context, and which changes can warrant review after login.
More news
Operational technology
Europe’s Supermarket Freezer Attacks: How Did Hackers Spoil the Food?
· 2 min read
