Binance Publishes October 29 Security Incident Report: North Korean Hackers Stole $6.34 Billion via Fake Interviews and Trojans

North Korean hackers steal $6.34 billion from Binance — revealed! Binance has just released its official security investigation report: A carefully disguised fake job interview and a 3,414-byte antivirus-evading trojan that replaced pyenv allowed North Korean hackers to lurk for four months and infiltrate a hot wallet. A 36-second video takes you through a complete replay of the most expensive social engineering penetration attack in business history!

Binance just today released its preliminary investigation report on the October 29 security incident,

fully disclosing the complete attack chain of how North Korean hackers lurked for four months through a job interview and ultimately made off with $6.34 billion in assets.

This was not at all the brute-force keyboard pounding seen in movies, but rather a nation-state-level penetration operation that took top-tier social engineering, an antivirus-evading trojan, and the Ethereum EIP-7702 authorization vulnerability to the extreme.

The breakthrough point for the entire heist began with nothing more than a public résumé that a Binance engineer posted on a job-hunting website:

Step one: a live, face-on video interview to completely dismantle their defenses. The hacker posed as the director of a high-paying project and proactively contacted this engineer, arranged for a fake HR person to conduct a live, face-on video interview, and the other party even proactively sent social media accounts with lifestyle photos and daily videos; the second round of interviews moved to a chat app, where the so-called CEO personally stepped in to talk, bringing the sense of trust to full capacity.

Step two: run a technical test on the work computer. Near the end of the interview, the fake CEO asked him to download a code repository to do a technical test; the engineer casually ran it on his work computer, and the malicious script automatically executed during the installation phase, silently replacing the legitimate development tool pyenv on the computer with a 3,414-byte poisoned trojan that connected directly to the hacker server and automatically erased traces, and at the time the endpoint antivirus software on the Binance computer was at zero alerts.

Step three: use internal AI tools as a springboard for lateral movement. After the hackers took control of this computer, they probed along the company's internal AI tools, successfully took control of the permissions of a core wallet operations engineer, and obtained the highest-level token for container deployment. Step four: raid the hot wallet signing system and use Ethereum EIP-7702 to steal a huge sum. On October 29, the hackers sneaked into the system and deployed malicious containers, bypassing the normal withdrawal channel, and within just a few minutes transferred out 233 million XRP, 970,000 SOL, 44.2 million OP, and 18,270 BTC from 5 hot wallets; they even used the Ethereum EIP-7702 smart contract authorization mechanism to continuously move funds on-chain, forcing Binance to send covering transactions to the zero address before the theft was completely stopped in the middle of the night.

So far $2.85 billion has been intercepted and frozen, Binance has promised to cover 100% of user losses in full, and proof of reserves has been topped up for 98% of the affected tokens.

This massive theft case has sounded the most piercing alarm bell for the entire industry: no matter how solid the encryption firewalls and MPC multi-signature wallets are, in the face of social engineering phishing that lasts for months and is precisely designed against the human weaknesses of real employees, they remain as fragile as a sheet of window paper.

Never run any external code on a work computer, and do not casually post sensitive positions on LinkedIn backgrounds, because in the eyes of top hackers, the vulnerability that is always easiest to breach is never the code, but the specific person sitting in front of the screen.