How a fake job interview reached Binance's signing service

What TRM Labs calls the largest crypto theft on record took about four hours to carry out and months to set up.TRM Labs, North Korea Steals USD 6.36 Billion From Binance; Binance, 29 October Binance Security Incident: Initial Findings and Response Update (3 November 2026). In the initial findings it published on 3 November, Binance says the attacker “exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process,” and puts the impact at approximately USD 6.34 billion. Its account of how anyone got that far starts in June with a tampered download, and runs through a fake job interview in September.

The lure

Binance dates the first exposure to June 2026. An engineer on its wallet DevOps team downloaded a tampered installation of a developer tool while looking for a popular AI coding tool, the exchange says. Its security team detected the anomaly, replaced the device and rotated all related credentials. Even so, the exchange writes, that engineer’s role and his colleagues on the wallet infrastructure team “was exposed to the hacker”.

The second stage came in September. A software engineer whose profile on a job-hunting platform mentioned Binance was contacted by someone posing as a Project Director. A second-round interview followed with a person claiming to be the CEO of a fictitious company. Near the end, the engineer was instructed to download an “assignment” containing a malicious code repository onto his work computer. Binance says the malware was not detected by endpoint security at the time. It adds that its security team detected and prevented 57 suspected North Korea-linked cases during 2026.

On 20 October, Binance says, the attacker used that engineer’s compromised computer and an internal AI tool to gain control over two more engineers, one from wallet DevOps and one on wallet software.

The signing service

The final step took place on 29 October. Between 17:15 and 19:56, Binance says, the attacker logged onto the second wallet engineer’s computer, used credentials stolen from the DevOps engineer, deployed a container and triggered a malicious script. That is how the exchange says the attacker reached the signing service, the internal component that produces the signatures for wallet transactions.

Why the service signed is not in the report. Binance says some technical details will remain confidential. Outside analysts have offered readings. TRM Labs wrote that the most likely explanation is that the attacker gained the ability to make the hot wallet signing system sign transactions of its choosing across chains. The security firm Halborn wrote that either the signing path signs raw digests or it accepts EIP-7702 authorizations as a message type, and “Both are inference”.Halborn, Inside the Largest Crypto Theft on Record. Halborn also wrote that the report does not answer why the service did what it was asked.Halborn, Binance Hack Report: The Signing Service Answered, Four Days On.

What EIP-7702 did

Binance describes EIP-7702 as a feature that lets an account delegate certain execution rights to a smart contract without exposing the private key. The attacker used it, the exchange says, to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.

The Ethereum record matches that count. One transaction from the attacker’s operator wallet, at 20:20:59 UTC, carries 50 authorizations, all on chain ID 1 and all naming the same Binance hot wallet. Their nonces run from 18,914,824 down to 18,914,775. One applied and 49 were skipped as invalid.Blockscout record of the type-4 transaction carrying 50 EIP-7702 authorizations (block 26300753, 2026-10-29 20:20:59… The first sweep followed 3 minutes 24 seconds later.Blockscout record of the first sweep transaction from Binance 14 (block 26300770, 2026-10-29 20:24:23 UTC). Six and a half hours earlier, the same operator wallet had tried the method on a test wallet with three authorizations, of which one applied.Blockscout record of a rehearsal type-4 transaction from the same operator wallet (block 26298813, 2026-10-29…

Delegation explains Ethereum and nothing else. Halborn wrote that “Nine other chains lost money through nothing more exotic than correctly signed transfers,” which it called the strongest evidence that the compromise “sat in the signing path rather than in one wallet’s key”.

Four hours

Binance lists the drain in pieces. Between 20:05 UTC and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Halborn wrote that Binance’s internal alert fired after outflows on Solana and Optimism, and that Bitcoin, the Ethereum delegation and Tron followed within fifteen minutes. On Bitcoin, a hot wallet sent 18,270 BTC.

Suspending withdrawals did not end it. The exchange says suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations. At 00:10 UTC on 30 October it executed a new authorization from the Binance14 hot wallet to the zero address, clearing the delegation. From the delegation landing to its removal was about 3 hours 49 minutes.

What was frozen

Frozen is not recovered. Binance says approximately USD 2.85 billion has been frozen or intercepted. Against its own USD 6.34 billion, that is 45%. Others count similarly: Chainalysis said about $2.8 billion was frozen as of 11:30 AM ET on 3 November,Chainalysis, The $6.4 Billion Binance Hack: Tracing the North Korea Link. Elliptic said $2.85 billion, 44% of the theft,Elliptic, The largest theft in history: North Korea behind the $6.4 billion Binance hack. and TRM counted about USD 2.7 billion as of 00:30 UTC on 30 October.

Tether said it froze more than $1.5 billion in USDT within 30 minutes of the hack.Tether, Tether Freezes Over $1.5 Billion From Binance Hack. Halborn’s freeze table, citing an outside chronology, puts the first Tether freeze on Ethereum at 21:01:35 UTC, 37 minutes after the first sweep.

Binance also says 98% of the impacted token assets have been replenished. That is the exchange refilling user assets, not funds clawed back from the thief.

Attribution, and which number

The FBI said North Korea was responsible for the theft of more than $6 billion from Binance, on or about 29 October,FBI, North Korea Responsible For $6 Billion+ Binance Attack (31 October 2026). and calls the activity “TraderTraitor”. Binance cites the FBI’s information in its own report. Chainalysis attributes the hack to TraderTraitor, and says stolen Binance funds commingled on-chain with funds from last month’s Bitget theft, which was attributed to North Korea.

The figures differ by who counted and when. Binance says USD 6.34 billion. TRM valued each transfer at the price at the moment it was taken and got approximately USD 6.36 billion, and about USD 6.23 billion at later prices. Elliptic puts it at $6.43 billion, using transfers at the time of theft and DefiLlama prices, and Chainalysis says approximately $6.4 billion.

Binance says the investigation continues and its findings will be subject to further independent review.