GodBoyOnChain
Newbie
- Nov 11, 2026
- 14
- 4
so binance finally dropped their report on the hack and honestly the way it went down is wilder than the numbers. it wasnt some genius exploit on the exchange itself, it started with a job interview lol.
back in june one of their wallet devs installed a tampered copy of homebrew from a paid ad at the top of search results, password stealer rode along with it. binance caught it, swapped the machine, reset everything. but the attackers already knew who worked on the wallet team, and thats the part that mattered.
then in september the same crew came back as a fake recruiter. fake company that didnt exist, two interviews, first a video call with a fake hr lady showing off a profile full of personal photos, then a fake ceo who moved the chat to a messaging app and asked the guy to download a coding assignment and run it on his work laptop. he did. that was the door in.
october 20 they used that machine plus one of binances internal ai tools to take two more machines, three wallet engineers owned by then. october 29 a session opens on the third guys machine, a container spins up with creds stolen from the first guy, and a script hits the internal service that signs wallet transactions. from there its just outflow, 6.3 billion gone in under four hours.
the malware itself was brand new, never seen before, corporate antivirus didnt even flag it. it replaced a legit piece of pyenv and phoned home, then wiped its tracks.
the nasty bit is the ethereum side. they used eip-7702 to get a contract they controlled partial rights over a hot wallet, and those authorizations live on chain so freezing withdrawals did nothing. and the wallet was mpc protected which sounds safe but it meant binance had no single key to cancel the delegation. it only got revoked after midnight.
fbi pinned it oct 31 on tradertrader, north korea linked, same crew behind the fake interview stuff. binance says they blocked 57 north korea linked threats this year alone. of the money, about 2.85b frozen or intercepted, 3.11b still sitting in theft linked addresses, 124m already converted to btc. binance covered the loss themselves, 98 percent replenished by oct 31.
my takeaways, and these are for us not binance. recruiter code never runs on your real machine, vm or throwaway laptop or the interview ends there. never install tools from a sponsored link, type the address yourself. and your coins are only as safe as the exchanges internal security, binance could eat 6.3b, most exchanges cant. serious money on one platform is the risk youre taking whether you think about it or not.
has anyone here actually been approached by one of these fake recruiters? curious how common it really is, i keep hearing about it but never from someone it happened to.
back in june one of their wallet devs installed a tampered copy of homebrew from a paid ad at the top of search results, password stealer rode along with it. binance caught it, swapped the machine, reset everything. but the attackers already knew who worked on the wallet team, and thats the part that mattered.
then in september the same crew came back as a fake recruiter. fake company that didnt exist, two interviews, first a video call with a fake hr lady showing off a profile full of personal photos, then a fake ceo who moved the chat to a messaging app and asked the guy to download a coding assignment and run it on his work laptop. he did. that was the door in.
october 20 they used that machine plus one of binances internal ai tools to take two more machines, three wallet engineers owned by then. october 29 a session opens on the third guys machine, a container spins up with creds stolen from the first guy, and a script hits the internal service that signs wallet transactions. from there its just outflow, 6.3 billion gone in under four hours.
the malware itself was brand new, never seen before, corporate antivirus didnt even flag it. it replaced a legit piece of pyenv and phoned home, then wiped its tracks.
the nasty bit is the ethereum side. they used eip-7702 to get a contract they controlled partial rights over a hot wallet, and those authorizations live on chain so freezing withdrawals did nothing. and the wallet was mpc protected which sounds safe but it meant binance had no single key to cancel the delegation. it only got revoked after midnight.
fbi pinned it oct 31 on tradertrader, north korea linked, same crew behind the fake interview stuff. binance says they blocked 57 north korea linked threats this year alone. of the money, about 2.85b frozen or intercepted, 3.11b still sitting in theft linked addresses, 124m already converted to btc. binance covered the loss themselves, 98 percent replenished by oct 31.
my takeaways, and these are for us not binance. recruiter code never runs on your real machine, vm or throwaway laptop or the interview ends there. never install tools from a sponsored link, type the address yourself. and your coins are only as safe as the exchanges internal security, binance could eat 6.3b, most exchanges cant. serious money on one platform is the risk youre taking whether you think about it or not.
has anyone here actually been approached by one of these fake recruiters? curious how common it really is, i keep hearing about it but never from someone it happened to.
