TECHNOLOGY · ANALYSIS
Binance describes an attack combining fake recruitment and compromised internal tools
According to Binance's investigation account reported by Ars Technica, the attackers combined social engineering, malware and the compromise of an internal AI tool. The episode also highlights the limits of suspending withdrawals when authorizations are recorded on the blockchain.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Binance attributes the cryptocurrency theft to a campaign prepared over several months, according to an Ars Technica article published on November 4. The company says the attackers initially targeted $6.34 billion and that $2.85 billion was frozen or intercepted. It says it has set aside the funds needed to cover the loss. These details remain findings from its ongoing investigation.
The account describes several entry points. One engineer reportedly downloaded an altered version of Homebrew. Another was reportedly approached on a recruitment platform and then led to run malicious code presented as an interview exercise. According to Binance, the attackers then used a compromised computer and an internal AI tool to take control of other engineers' devices.
The transfer phase reportedly exploited access to the internal wallet signing service. In particular, the attackers allegedly hijacked Ethereum's EIP-7702 authorization mechanism to delegate certain permissions to a contract under their control. According to the account, these authorizations could operate independently of the usual withdrawal infrastructure.
The technical lesson remains conditional on confirmation of this reconstruction: suspending withdrawals is not necessarily enough when separate permissions still allow assets to be moved. The reported role of an internal AI tool does not, on its own, establish its precise vulnerability or allow the entire intrusion to be attributed to AI.