Binance says $6.3bn hack began with fake job interview months earlier
Binance told reporters the 29 October theft was the end of a months-long campaign in which attackers posing as recruiters gave an engineer a coding test laced with zero-day malware, later reaching wallet engineers' machines and using Ethereum's EIP-7702 to take control of a hot wallet; containment took about four hours. The FBI attributes the attack to North Korea's TraderTraitor group, which Pyongyang denies, and roughly $2.85 billion has been frozen while laundering of the remainder continues across thousands of wallets. Former CEO Changpeng Zhao warned the industry to expect more AI-assisted attacks, though he offered no evidence AI was used in this one.