Binance Hack Traced to AI Tool Breach and Fake Job Interviews

The breach began in June when a DevOps engineer inadvertently downloaded a tampered Homebrew installation while searching for an AI coding tool. Although security teams initially rotated credentials and replaced the hardware, the incident exposed critical internal roles. By September, attackers targeted a second engineer through a legitimate recruitment platform, conducting video interviews under the guise of a fictitious company. This interaction led to the installation of a malicious development environment that bypassed standard endpoint security.

On October 20, the attackers leveraged the compromised machine and an internal AI tool to seize control of two additional engineers' computers. These devices held the necessary deployment tokens to reach the exchange's wallet signing operations. During the October 29 attack, the hackers deployed a malicious script to transfer massive quantities of XRP, SOL, OP, and BTC. Notably, the perpetrators utilized Ethereum’s EIP-7702 mechanism to delegate wallet permissions to a smart contract, allowing the unauthorized transfers to persist even after Binance suspended standard withdrawal services.

Binance CEO Richard Teng confirmed that the exchange has replenished 98% of the affected assets, ensuring no user bears the loss. While the FBI has attributed the theft to North Korean activity, the exchange has since rebuilt its wallet environment and commissioned independent cybersecurity audits to bolster its developer security and behavioral monitoring systems.