Binance says $6.4B hack began with fake job interview

Binance says the record $6.4 billion hack began with a fake job interview: North Korea-linked attackers spent months compromising Binance employees and internal systems before exploiting its hot-wallet signing infrastructure through Ethereum's EIP-7702 mechanism. The FBI had already attributed the Oct. 29 heist — the largest crypto exploit in history — to North Korea's TraderTraitor group; Kim Yo Jong denied any role and suggested the U.S. could be behind the theft.

Binance reopened withdrawals on Nov. 1 after a 45-hour freeze, absorbed the losses and replenished roughly 95% of the stolen assets, while stablecoin issuers froze over $2.4 billion of funds. Co-founder CZ warned that AI tools are lowering the barrier for complex breaches, predicting more AI-driven hacks — though investigators found no evidence AI agents laundered the stolen funds.

• Arbitrum's Security Council moved about $30 million out of the exploiter's address, unlockable only by an ArbitrumDAO vote.
• More than $6 billion in crypto has left Binance-linked wallets since the theft; Elliptic found the laundering relied on scripts rather than AI agents.