Binance Says Fake Hiring Scheme Moved $6.34B Without Authorization

Binance said attackers transferred about $6.34 billion in digital assets through its internal wallet-signing service after a fake recruiting approach compromised an engineer’s work computer, exposing a weakness in on-chain authorizations during the exchange’s response.

The incident occurred Oct. 30, when transfers bypassed Binance’s normal withdrawal process. By the time of a company discussion, co-CEO Richard Teng said about $2.85 billion had been frozen or intercepted, a figure included in Binance’s earlier update on the funds.

How did the fake hiring approach compromise Binance?

Chief Security Officer Jimmy Su said a person posing as a project lead contacted a Binance software engineer through a recruiting platform in September. The engineer was then asked to run a coding assignment on a work computer.

Su said the assignment repository “contained malicious software that ran during setup.” Binance believes the software included a zero-day that the company’s endpoint security product did not detect, allowing the attackers to compromise the engineer’s device.

Once inside, the attackers created authorizations on the blockchain. Su said those authorizations remained active after Binance paused withdrawals, so the operational pause did not cancel the transactions the attackers could execute.

Why did stopping the outflow take several hours?

The affected hot wallet used multi-party computation (MPC), and no single private key could immediately revoke the outstanding authorizations. Su said the team had to design and execute a revocation procedure; that process took several hours to stop further outflows.

That sequence separated two controls that had operated as one: Binance could stop new withdrawals through its normal process, but it could not erase authorizations already granted on the blockchain. The response therefore required a wallet-specific revocation procedure rather than a simple pause.

Teng said the affected wallets and asset positions belonged to Binance, not customers, and the exchange would cover the losses. By the time of the discussion, Binance had replenished about 98% of the affected tokens; Teng said the remaining assets had lower liquidity and would take longer to replace.

The loss therefore sits with Binance’s own treasury and token inventory, while customers did not bear the reported shortfall. For the exchange, the immediate financial work is replacing the remaining less-liquid positions, alongside the operational cost of rebuilding and reviewing the affected infrastructure.

What has Binance changed?

Binance completed emergency fixes by Nov. 3. The work included rebuilding affected wallet systems and internal AI tools in a new environment, replacing the employee’s device and revoking credentials.

The exchange plans to bring in outside security experts to review its investigation and recommend changes. It also plans to strengthen system isolation and AI-based threat detection, adding controls around the separation of internal systems and the detection of malicious code.

Those measures respond to the path described by Su: an undetected package ran during setup on an engineer’s device, while signing authorizations survived the first-line withdrawal pause. Rebuilding the environment and changing credentials address the compromised workstation and access paths identified in the incident.

Why is Binance sharing technical details?

Co-CEO He Yi said she supported sharing technical details despite objections from some senior managers and the legal team. She argued that “the information could help other platforms improve security.”

Binance also plans to establish a security research fund and work with AI companies and cybersecurity groups. Those steps would extend the response beyond internal repairs into funded research and industry coordination, although the exchange did not disclose a fund amount or timetable in the discussion.

For other exchanges, the immediate lesson is that pausing withdrawals must be paired with a tested procedure for revoking pre-existing on-chain authorizations. Binance’s next disclosed milestones are the outside security review and the replacement of the remaining, less-liquid tokens, with no new completion deadline announced.