A coding assignment sent to a job-seeking Binance engineer in September ended with about $6.3 billion in crypto leaving the exchange on October 29. Binance’s November 3 initial report addresses the question left open in Datafloq’s first report on the hack: how the attacker gained signing authority even though the company says it found no evidence that any wallet private key leaked.
Four Stages Between a Search Result and the Signing Service
Binance says the intrusion began in June, when an engineer on its Wallet DevOps team searched for an AI coding tool and downloaded a tampered Homebrew installation. Binance’s security team detected the activity, replaced the device and rotated credentials, but the attackers had already learned the engineer’s role and who their colleagues were. A person familiar with the incident told Reuters that the malicious version of the tool had been placed in an advertisement, so it ranked above the legitimate one in search results.
In September, someone posing as a project director contacted a second engineer through a job-hunting platform. A video interview with a fake HR representative followed, then a second interview with a person posing as the CEO of a fictitious company. Near the end, the engineer received an assignment to download a code repository onto a work computer. Its setup process swapped a component of a legitimate development tool for a poisoned version that contacted an attacker-controlled server and removed traces of its activity, and Binance says its endpoint security did not detect it.
On October 20, the attacker used that computer and an internal AI tool to take control of two other engineers’ machines. One, belonging to the engineer compromised in June, held a container deployment permission token. On October 29, the attacker used that token to deploy a container and run a malicious script. The script reached an internal wallet signing service, which let the attacker start transactions outside Binance’s normal withdrawal process.
Binance’s first explanation pointed to a compromised DevOps engineer’s laptop. By the next day, Binance said its investigation had found “additional points of breach,” and co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions.” The November 3 report lays out the sequence.
Why Suspending Withdrawals Did Not Stop the Drain
At about 20:05 UTC on October 29, five hot wallets sent 233.46 million XRP to an attacker-controlled address in four minutes. Wallets on other networks followed, including Solana, Optimism and bitcoin, and the Ethereum sweep of the wallet labeled Binance 14 landed at 20:24 UTC. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC, nearly four hours after the attack began.
The Ethereum hot wallet used multiparty computation, crypto.news reported, so no single private key was available to revoke the delegation at once. Suspending withdrawals therefore did not cancel the permissions the attacker had already set through EIP-7702, the feature that lets a wallet hand execution to smart contract code. Binance said it was forced to build new procedures to revoke authorizations, which slowed its response, and it cleared the delegation on Binance 14 at 00:10 UTC on October 30.
One way to read the sequence is that it resolves a puzzle from the first hours. EIP-7702 is specific to Ethereum-compatible chains, so it could not explain the XRP, Solana and bitcoin outflows, while a compromised signing service that sits above the individual chains could reach all of them. That reading fits TRM Labs’ early assessment, reported by Decrypt, that the breach pointed to a compromise of Binance’s signing infrastructure and not a weakness in any blockchain.
Attribution, Freezes and the Policy Response
On October 31, the US Federal Bureau of Investigation (FBI) attributed the theft to TraderTraitor, a North Korean state-sponsored hacking unit, and said the group was converting stolen assets mainly into ether. The bureau expects the group to try laundering the funds through decentralized finance and “instant swap services.” North Korea rejected the finding. Kim Yo Jong, the sister of leader Kim Jong Un, called the US assertion “absurd rhetoric” in a statement published by state media. Binance says it detected and prevented 57 suspected North Korea-linked cyberthreats in 2026.
Binance says about $2.85 billion of the roughly $6.34 billion it puts on the affected assets has been frozen or intercepted, a figure subject to reconciliation and market price changes, down from an earlier estimate of about $3 billion. Tether alone said it froze more than 1.5 billion USDT.
US Commodity Futures Trading Commission (CFTC) Chairman Michael Selig told CNBC the hack “proves our exact point” about the crypto market rules his agency proposed earlier in October, and he pitched a federal registration option for offshore exchanges. US Senator Cynthia Lummis, a Wyoming Republican, argued that the CLARITY Act would have given freezing teams better tools. Neither is law: the CFTC measure is an advance notice of proposed rulemaking with public comments open until December 14, and the CLARITY Act failed a US Senate procedural vote on September 15.
Repayment Nearly Complete, Reserve Proof Still Partial
Binance says it has replenished about 98% of the affected assets, up from 95% on November 1, and it is buying the remaining, less liquid tokens through market and over-the-counter channels. The money came from part of its Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund and its corporate treasury, and Binance plans to refill SAFU to about $1 billion. Binance says it is repaying all customers whose funds were stolen.
Customers moved quickly once withdrawals reopened. Between 06:00 and 15:30 UTC on November 1, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion, the company said in a post on X.
The reserve proof covers only part of the affected assets so far. Binance says a zero-knowledge proof for its 00:00 UTC snapshot on October 31 shows backing of at least 1:1 for 10 tokens, including BTC, ETH and USDT, and that the open-source verifier customers use to check their balances has been independently audited. Part 1 reported CoinDesk’s estimate that ether backing would drop to about 94% until Binance replaced the stolen ether, and if Binance’s figures hold, that gap has closed. A new snapshot covering 44 tokens followed at 00:00 UTC on November 4, with the proof expected to take 50 to 60 hours. CryptoSlate noted that the first proof reflects balances at the snapshot and does not establish Binance’s current financial position or independently audit its solvency.
What the Attack Chain Says About Signing Security
Our take: By Binance’s account, this attack succeeded without any evidence of a leaked private key. It needed a search ad, a fake recruiter, a deployment token sitting on an engineer’s computer and an internal AI tool with reach into other machines. Binance says it then had to build revocation procedures during the incident, which slowed its response. Exchanges should treat developer laptops, deployment tokens and internal tools as part of the signing perimeter, and they should rehearse how fast they can revoke an authorization before they need to.
Binance’s next public checkpoints are the 44-token reserve proof, the last 2% of replacement purchases and the detailed technical post-mortem it has promised. The industry’s checkpoint is quieter: other exchanges can now test whether the same chain, from a poisoned download to a signing service, would work against them.
The post Binance Hack: How a Fake Job Interview Reached the Wallet Signing Service appeared first on DataFLOQ.
