Mentioned in This Article
1. What did Binance say about the North Korea crypto hack?
Binance said on Tuesday, November 3, that the North Korea crypto hack behind its $6.3 billion loss began with a fake job interview. In a media briefing, the exchange described a months-long campaign by attackers linked to North Korea, and called the theft the largest heist in the history of crypto. About $2.85 billion has been frozen, and roughly 98% of affected tokens have been replaced.
The account came from two senior figures at the exchange. Richard Teng, who leads Binance, told reporters that the incident was not an opportunistic strike but a campaign assembled over many months, and that the FBI has attributed it to North Korea. Jimmy Su, the exchange's chief security officer, walked through the chain of events, from a single recruitment approach in September to the moment funds began leaving in late October.
The briefing matters because it replaces speculation with a sequence of dates and technical steps. It shows that the weakest point was not a flaw in the blockchain or in the exchange's cryptographic design, but a person who was persuaded to run software on a work computer.
2. How did a job offer become the way in?
According to Su, the operation started in September, when a software engineer at Binance was contacted through a legitimate job platform. The person reaching out claimed to be a project director, which gave the approach the look of an ordinary recruiting exchange of the kind that skilled developers receive regularly.
The attackers then invested effort in building credibility. A fake human resources representative interviewed the engineer by video and shared a social media account filled with personal photographs, a detail meant to make the persona seem like a real individual with a real life. A second interview followed, this time with someone presented as a chief executive. That conversation ended with the engineer being asked to download a coding assignment onto his work computer.
The assignment was the weapon. Su said it contained zero-day malware, meaning software that exploits a weakness not yet known to the vendors of security products. The code evaded the endpoint security tools installed on the machine, so no alarm was raised when it ran. From that moment, the attackers had a foothold inside the exchange's environment.
3. Why do attackers pose as recruiters?
Fake hiring processes work because they match the normal behavior of the target. Developers are expected to take technical tests, and a test is usually a piece of code that must be opened and executed. An engineer who treats the task as routine is, in effect, being asked to run an unknown program with the access rights of his own account. Security teams spend heavily on perimeter defenses, yet this route arrives through a channel that employees consider personal and professional rather than hostile.
The tactic is a form of social engineering, the practice of manipulating people instead of breaking software. It rewards patience. The interviews, the shared photographs and the second round with a supposed chief executive all served one purpose: to lower the engineer's guard until he downloaded the file. That patience is consistent with Teng's description of the operation as a campaign built over many months.
4. What happened in June and October?
The September approach was not the first sign of trouble. Su said that in June, a different engineer installed a tampered Homebrew package while searching for an AI tool. Homebrew is a widely used package manager that developers rely on to install software on their machines. Binance detected the problem at the time and replaced the affected device. Even so, the engineer and his colleagues on the wallet team were still regarded as exposed, because an attacker who had touched one machine might have learned enough to reach others.
The decisive phase came in October. On October 20, the attackers used the compromised machine together with an internal AI tool to reach the computers of two wallet engineers. That step carried them from a developer workstation toward the people who manage the systems that handle customer funds.
On October 29, they used stolen credentials to deploy a container and run a malicious script. A container is an isolated environment in which software can be run, and it is a common building block of modern infrastructure. Funds began leaving the exchange at 20:05 UTC that day.
5. How did EIP-7702 let the attacker move funds?
Su said the attacker used an Ethereum feature known as EIP-7702 to obtain execution rights over a Binance hot wallet. A hot wallet is one connected to the internet so that it can pay out withdrawals quickly, as opposed to a cold wallet kept offline. EIP-7702 is an Ethereum improvement proposal that allows an ordinary account to delegate how it executes transactions to the code of a smart contract. In this case, the attacker set up malicious execution permissions over the wallet, which allowed transfers to happen outside the exchange's normal withdrawal process.
That detail explains why the theft could proceed without the usual approval path. The funds did not leave through a customer withdrawal request that the exchange's own systems would have reviewed. They left through a permission the attacker had planted on the wallet itself.
6. Why could the access not be revoked at once?
Binance's hot wallets use multiparty computation, often shortened to MPC. In an MPC setup, the secret needed to sign transactions is split into pieces held by different parties, so that no individual holds a complete private key. The design is meant to protect against the loss or theft of any single key, and it is widely regarded as a strong safeguard.
Su said the same property worked against the exchange in this case. Because no single key existed, no single key could be used to revoke the access the attacker had set up. The defenders had to contain the incident by other means. Containment was completed at 00:10 UTC on October 30, roughly four hours after the first funds moved.
The episode shows a trade-off in wallet design. Splitting keys reduces the risk that one stolen secret empties a wallet, but it can also make emergency changes slower when a delegated permission has to be undone.
7. How much has been recovered or frozen?
Teng said that about $2.85 billion has been frozen. Of the tokens that were affected, roughly 98% have been replenished with the company's own funds. He said users will not be affected by the loss, meaning customer balances are being made whole by the exchange rather than by the people who hold accounts there.
The freeze figure matters because stolen digital assets can move quickly across chains and between addresses. Freezing a large portion within days limits what the attackers can convert into spendable money, though the briefing did not say whether any of the frozen amount would be returned or on what timetable.
8. What does the case show about exchange security?
The sequence described by Binance reads as a layered operation in which each step relied on the one before it. A recruitment approach produced a compromised workstation. The workstation, together with an internal AI tool, gave access to wallet engineers. Stolen credentials then allowed a container to be deployed, and a malicious script used an Ethereum permission feature to pull funds. Defending against any one stage would have interrupted the chain, which is why security specialists generally argue for controls at every layer instead of reliance on a single strong barrier.
Several of those layers concern people and tools rather than cryptography. Employees who are approached on professional networks need to treat unsolicited coding assignments with the same suspicion they would apply to an unexpected attachment. Teams that install software from public repositories, including helpers for artificial intelligence work, need ways to confirm that a package has not been altered. Internal tools that can reach sensitive machines need tight limits on what they may touch, because in this case an internal AI tool was one of the bridges the attackers used.
For customers, the practical meaning is narrower. Binance said users will not be affected, and the company has restored most of the affected tokens from its own resources. The larger question for the industry is how many other firms receive similar approaches. Binance said it blocked 57 suspected North Korea-linked attempts this year, and it is unlikely to be the only target of such efforts. Exchanges, wallet providers and custody firms all employ developers with access to systems that hold large sums, and all of them can be reached through the same kind of fake recruiter.
9. What is Binance doing next?
Binance said it will bring in independent cybersecurity experts to review the incident. An outside review is a common step after a breach of this size, since it gives customers, partners and regulators an assessment that does not rest only on the company's own account.
The exchange also put the attack in context. It said it blocked 57 suspected North Korea-linked attempts this year, which suggests that the pressure on its staff and systems was sustained rather than a one-off event. For an organization that handles this volume of customer assets, the lesson drawn from the briefing is that hiring contacts, developer tools and internal software all belong inside the security perimeter, alongside wallets and keys.
The briefing did not set a date for the outside review to conclude. Readers should watch for any published findings and for further detail on how the frozen funds will be handled.