Binance Hack Interview: Fake Job Led to $6.3B Breach

The Binance hack interview was how the $6.3 billion theft started, according to Binance’s own incident report. Binance says a software engineer was recruited through a fake hiring process in September and downloaded a malicious coding assignment to a work computer. That is the company’s account, reported by CoinDesk and The Block. It has not been independently verified.

How the Binance hack interview attack worked

First, the setup. In June, Binance says another engineer installed a tampered Homebrew package while looking for an AI coding tool. Binance caught it and replaced the device. However, details about that engineer’s role and colleagues were exposed.

Then came September. Per CoinDesk, a contact posing as a project director approached an engineer on a legitimate job platform. A fake HR rep and a purported CEO interviewed him by video. The second interview ended with a coding assignment, which carried malware that evaded endpoint security.

On October 20, Binance says the attackers used that machine and an internal AI tool to take over two wallet engineers’ computers. On one they found a container deployment permission. Then, nine days later, they used it. Funds began leaving at 20:05 UTC on October 29, and containment finished at 00:10 UTC on October 30.

What the Binance hack interview report leaves out

The AI tool is the loose end. The Block notes that the report does not say how it was compromised. Binance also says the attacker used Ethereum’s EIP-7702 to gain execution rights over a hot wallet, and that its multiparty computation setup meant no single key could revoke that access, per CoinDesk. Co-CEO Richard Teng called it “a months-long campaign” and said the FBI links it to North Korea. Pyongyang’s side calls that a “grave political provocation.”

The numbers: about $2.85 billion frozen or intercepted, and 98% of affected assets replenished with company funds. Binance also says it blocked 57 suspected North Korea-linked attempts this year. For the money trail, see our pieces on the FBI naming North Korea and why Elliptic sees scripts, not AI.

Miner math: what the Binance hack means for your margin

Here is the live maths on November 3. Bitcoin is $77,633 and the network is 1023 EH/s, so hashprice is about $34.40 per petahash per day. That is what one PH/s of hashing earns before power.

Numbers are profit per day after electricity, at the three power prices shown. Break-even is the most you can pay per kilowatt-hour before the machine loses money. Specs are the manufacturer ratings; network data comes from mempool.space. Try your own power price in our free bitcoin mining profit calculator. See what these machines really sold for in our used ASIC miner price index. Want to run the same numbers on a machine you can buy today? See our used ASIC miners, or buy several at once through bulk lots.

If the fallout pushes bitcoin down another 10%: the break-even power price on an S19k Pro falls from 6.2 to 5.6 cents per kilowatt-hour. At 8 cents, daily profit goes from -$1.12 to -$1.52.

The blunt answer for miners

This report changes nothing on the bitcoin network. Hashrate sits near 1023 EH/s per mempool.space. What hits your margin is price, and a hack of this size keeps sellers nervous. Check the table above against your power price. If your S19 is under water, see our we buy used miners page or the mining economics guides.

Also, we take one lesson from it. If your team hires remotely, a “coding test” sent to a work laptop is an attack path. Run it on a throwaway machine.

-Nick
ING Mining

This is general information, not financial advice. Crypto is volatile, and exchanges can fail. Please do your own research.

How this story was made: drafted with the help of AI tools from public sources, then edited by Nick Squires. See our editorial policy. Spot an error? Email ns@ingmining.com.