Binance Details $6.34B Hack: Fake Job Interviews Used to Plant Malware, Internal AI Tool Exploited

Binance released an initial report on its October 29 hack, revealing that attackers used fake job interviews and malware to compromise an engineer’s device in September. They later exploited an internal AI tool to gain access to wallet engineers, then used stolen credentials to compromise a wallet signing service and abuse Ethereum’s EIP-7702 authorization mechanism. Binance said withdrawal suspensions alone could not stop the malicious on-chain authorizations, which required a separate revocation process. Of the $6.34 billion in affected assets, approximately $2.85 billion has been frozen or intercepted. Binance said 98% of affected token assets had been replenished as of October 31, with sufficient funds set aside to cover all losses. The investigation remains ongoing.