A fake job interview helped attackers reach Binance’s wallet infrastructure before its October 29 security incident, according to the exchange’s initial findings published on November 3. Binance puts the affected assets at approximately $6.34 billion.
The report shifts attention from the stolen tokens to the employee computers and permissions that supported the attack. Its findings remain preliminary, with independent review still planned.
Key Takeaways
- Binance says a malicious recruitment assignment compromised an engineer’s work computer.
- The attack reached wallet signing, while Ethereum delegations complicated containment.
- Security reviews must cover employee devices, deployment access and permissions already established on-chain.
How the Attack Reached Wallet Systems
In its initial incident report, Binance describes a September recruitment approach that ended with an engineer downloading a malicious coding assignment. The attacker later used an internal AI tool to reach colleagues’ computers, obtained deployment credentials and launched the attack through a deployed container.
Binance says the intruder accessed an internal wallet-signing service and initiated transfers outside the normal withdrawal process. It has rebuilt affected systems, replaced devices and disabled related credentials. The company says it will absorb the financial impact.
These disclosures describe more than an individual clicking a suspicious link. The important question for exchanges is how far compromised employee access can reach before another control stops it. UEEx’s crypto hacks archive provides broader context on the different systems targeted across the industry.
Why Pausing Withdrawals Was Not Enough
Binance says malicious Ethereum authorisations allowed further movements after withdrawals were suspended. That exposes a difference between stopping a platform’s service and cancelling permissions recorded on a blockchain.
The EIP-7702 specification allows an ordinary Ethereum account to delegate execution to code at another address. The feature supports functions such as transaction batching and sponsored fees, but its security depends on what the account authorises.
A delegation can persist beyond the transaction that establishes it. Disabling an exchange interface does not itself change that blockchain state. Removing the delegation requires the appropriate on-chain authorisation; the specification includes a mechanism using the zero address to clear delegation code.
This does not mean EIP-7702 gives strangers unrestricted access to any wallet. Valid authorisation is still required. The distinction matters when interpreting headlines: a feature used after attackers gain signing access is different from an unauthenticated break into Ethereum itself.
What Exchange Security Teams Should Review
In its analysis, security firm StepSecurity recommends treating unfamiliar recruitment repositories as untrusted code. Disposable environments should have no production credentials, work sign-in sessions or connections to sensitive files. A convincing recruiter or a legitimate hosting platform cannot establish that downloaded code is safe.
StepSecurity also recommends mapping the identities, credentials and machines internal AI tools can reach. Teams should log who initiated an action and which identity actually performed it, restrict deployment access and test emergency revocation procedures before an incident. The firm notes that Binance has not named the internal AI tool or disclosed the precise mechanism used to reach other machines. Identifying a particular commercial product as the cause would therefore go beyond the published evidence.
For readers assessing custody arrangements, those are useful questions to ask alongside wallet storage methods. Our guide to crypto wallet security practices explains why protecting keys, devices and account access requires several safeguards.
What Users Can Do
Personal account controls cannot repair an exchange’s internal infrastructure. They still matter: use a unique password, enable strong authentication and access support through verified channels. UEEx’s guide to protecting crypto from hackers covers practical precautions against malware and account compromise.
During a developing incident, keep withdrawal availability separate from compensation claims and promises of recovery. Preserve transaction records, check the exact asset and network involved, and avoid sharing credentials with anyone offering to “unlock” funds.
Conclusion
Binance’s initial account connects a recruitment lure to production access and wallet signing. The wider security lesson is that controls must follow that entire path. Independent review will be important in assessing the findings and the changes made after the breach.
