Binance's $6.3 Billion Hack Began With a Fake Job Interview

Patient social engineering

The account points to a slow, human-focused intrusion rather than a single technical flaw. A fake recruitment process gave the attackers a way to reach staff, and access to employees and internal systems then set up the final attack on the signing layer that authorizes hot-wallet transactions.

Hot wallets are the internet-connected wallets exchanges use to process withdrawals and daily activity, which makes the systems that sign those transactions a high-value target.

Why it matters

The incident shows that even the largest exchanges can be breached through their own people and internal tooling, not only through smart-contract bugs or exchange software. It also ties a new Ethereum feature, EIP-7702, to a real-world exploitation path in the way the attackers used it against signing infrastructure.

For users and platforms, the lesson is that hiring channels, employee devices and internal access controls are part of the security perimeter. Exchanges that handle large hot-wallet balances are likely to face pressure to review how they vet outside contacts and how tightly they isolate signing systems.

Binance has not been quoted here on recovery of funds or further technical details, and those points remain unclear from the information available.