The Binance hack: a fake job interview, US$6.3bn and what Aave did

What happened on 29 October[11][9][10][8]

Binance is a centralized exchange (CEX): it holds customer funds for them. Such an exchange keeps most funds in cold wallets, cut off from the internet, and part in hot wallets, from which it handles withdrawals as they come in. On the evening of 29 October 2026 it was Binance's hot wallets that started sending huge amounts to the hacker's address.

According to TRM Labs, outflows began at 20:05 UTC, and most of the funds moved within about 20 minutes across ten networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. According to LlamaRisk, at 20:24 UTC a single transaction on Ethereum moved 167,464 ETH and 63 other tokens. A second wave hit wallets on Avalanche and Polygon around 23:05 UTC, almost three hours later.

Binance puts the total at about US$6.3bn, TRM Labs at US$6.36bn and Chainalysis at US$5.912bn at prices at the time of the theft. The previous record belonged to Bybit: US$1.5bn in 2025. Binance co-CEO Richard Teng says the hacked hot wallet held the exchange's own funds, and most customer assets sit in cold wallets.

How the hacker got in: from a fake job interview to a signature[1][2]

On 3 November Binance published its initial report. It calls the attack a multi-stage campaign and describes it step by step. The sequence below comes from that report, as covered by The Register and The Hacker News.

June 2026: an engineer on the Wallet DevOps team searched for a popular AI tool and installed a tampered version of Homebrew, a program for installing developer tools. Binance's security caught the malware, the computer was replaced and the passwords changed. According to Binance, though, the hackers learned who works on the wallet infrastructure.

September 2026: someone posing as a Project Director approached another engineer on a legitimate job-hunting platform. The first interview was on video with a fake HR person, who shared a social media account with photos and videos to build trust. The second was run by the supposed CEO of a non-existent company on a popular chat app. At the end the engineer got a recruitment assignment to download: a code repository that infected the engineer's work computer during setup. The malware swapped a part of a developer tool (pyenv from Homebrew), talked to the hackers' server and covered its tracks. Binance's security did not catch it at first.

20 October: from the infected computer the hackers abused Binance's internal AI tool and took over the computers of two more people, a Wallet DevOps engineer and a wallet software developer. The report does not say exactly how. The DevOps engineer's computer held a token with permission to deploy containers.

29 October, between 17:15 and 19:56 UTC: the hacker logged into the developer's computer, used the stolen token, deployed a container and ran a script. It reached the internal service that signs wallet transactions and ordered transfers outside the normal withdrawal process. Nobody stole a private key. The hacker made Binance's own system sign their orders.

How the Ethereum wallet was emptied: EIP-7702[3]

On Ethereum the hacker used EIP-7702. It is a feature that lets an ordinary wallet, with one signature, run the code of a chosen contract. According to Protos, at 20:20:59 UTC the hacker sent one transaction carrying 50 authorizations signed with the key of the Binance 14 hot wallet, each with a different nonce, because the wallet's counter kept rising with customer withdrawals. The network accepted the one that matched.

From then on Binance 14 ran the hacker's sweeper code, a contract that drains everything from a wallet. From 20:24:23 UTC it sent out 167,464 ETH and 1.62bn USDT, and through a separate function 823M USDC via another Binance wallet. From the Binance 16 wallet and from other networks the hacker moved funds with ordinary signed transfers. Binance removed the delegation from Binance 14 only on 30 October at 00:10:35 UTC.

Who is behind it[4][11][2]

As early as 30 October TRM Labs and Chainalysis attributed the attack to the North Korean group TraderTraitor, part of the so-called Lazarus Group. On 31 October the FBI issued an alert that also names North Korea and the TraderTraitor operation. The FBI published the hacker's wallet addresses and urged exchanges and analytics firms to block transactions linked to them.

According to the FBI, the hackers are converting the stolen funds mostly into ETH and may move them further through DeFi and instant swap services. The FBI attributed the Bybit theft of 2025 to the same group. Binance says it has foiled 57 North Korea-linked attack attempts since the start of the year.

Freezes: what could be stopped[11][10][5][8]

Stablecoins such as USDT or USDC have an issuer that can block the tokens at a given address. Tether froze 971.1M USDT at 21:01 UTC, and Circle 823M USDC three minutes later. Later, Tether chief Paolo Ardoino spoke of more than 1.567bn USDT.

Ripple (RLUSD), World Liberty Financial (US$27M in USD1 and US$2M in WLFI), First Digital (FDUSD), USDT0 and the Arbitrum Security Council, which moved US$30.5M in ARB and ETH to a frozen address, blocked their parts too. According to CoinDesk, about US$3bn is immobilized, mostly in USDT and USDC. The frozen tokens still sit at the hacker's addresses, they just cannot be moved.

ETH and BTC have no issuer, so nobody can freeze them. According to TRM, the hacker still holds more than 420,000 ETH and 18,270 BTC, about US$2.4bn. That is why in the first minutes they sold about 325M USDT for ETH, accepting a loss of more than 10% on the rate.

Why the hacker went to Aave[9][11]

Aave is a lending protocol: you deposit one token as collateral and borrow another against it. Between 20:58 and 21:01 UTC one of the hacker's wallets deposited 60M USDT on Aave V3 on Ethereum and borrowed 19,762 WETH, worth about US$44.6M at the time.

The aim was simple: swap tokens an issuer can freeze for ETH that nobody can freeze, and do it faster than Tether could react. The hacker never meant to repay the loan. They left the USDT on Aave and walked away with the ETH.

According to LlamaRisk, this was the hacker's only position on Aave, and after 21:01 UTC none of their wallets touched Aave again. The position holds US$59.9M of collateral against US$43.8M of debt, so it is over-collateralized and puts nobody who deposited on Aave at risk.

How Aave responded and what about US$14M[9][7][12][13]

Within 10 minutes of the first reports, Aave Labs, TokenLogic and Certora formed a single crisis team. Between 21:42 and 23:04 UTC the Guardian multisigs froze 175 Aave V3 markets on 16 networks and 117 Aave V4 markets on four. A frozen market takes no new deposits or loans, but you can still repay, withdraw and liquidate positions. The aim was to cut the hacker off from further loans.

On 30 October Aave unfroze all V3 and V4 markets. Nine assets, including USDT and USDC, temporarily have an LTV of 0, so no new loan can be taken against them: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP. Aave says its contracts were not affected and all positions remain fully collateralized.

Recovering funds is for now only a prospect. According to Binance co-founder Yi He, the collateral on Aave is not covered by a full freeze, and the hacker borrowed only about US$46M in ETH against it. Once law enforcement unlocks these funds, an additional US$14M can be recovered. By 4 November we found no report that any of it had been recovered.

What this means for Binance customers[5][6][8][1]

Binance says it will cover all losses from its own funds, including its SAFU fund (Secure Asset Fund for Users), and will not pass them on to customers. It has set aside more than US$6.34bn for this. By 1 November it had replaced about 95% of the stolen assets. The missing 5% are less liquid tokens outside the top ten, which are harder to buy back quickly. Binance also promises to rebuild SAFU to about US$1bn.

Withdrawals are coming back in phases. On 1 November from 06:00 UTC BTC, ETH, USDT, USDC, BNB and XRP reopened, and on 3 November from 04:00 UTC another 51 tokens on Ethereum and Solana. BNB Smart Chain, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, among others, are still waiting. Binance.US is a separate company and was not affected.

After the attack Binance rebuilt the wallet system and the internal AI tool in a new environment, replaced the infected devices, revoked those engineers' tokens and credentials and scanned every employee's computer. It promises a new Proof of Reserves covering more assets.

• Ignore messages about refunds, compensation and airdrops after the attack. Binance announces such things only on its official channels
• Never give anyone your seed phrase or 2FA codes, even someone who says they are support
• Keep on an exchange only what you trade. Move the rest to self-custody, ideally a hardware wallet
• Spread funds across several places, so that a pause at one exchange does not block everything

A lesson for everyone: the fake job interview[1][2]

The same trick works on ordinary crypto users, not only on exchange engineers. Someone offers a job, the interviews look professional, and at the end they ask you to download and run code, a meeting app or an assignment file. If that computer holds your wallet or a logged-in exchange, you can lose everything.

• Do not run code or programs from recruiters on a computer that holds your wallet, an exchange or your work
• Open a recruitment assignment only in a separate environment, such as a virtual machine or a spare computer
• Check the company independently: website, company register, people on LinkedIn. A social media account with private photos proves nothing
• Be careful when the conversation moves from a job platform to a chat app and suddenly gets rushed
• Install tools only from official websites, not from search results or ads