Binance says it lost $6.3 billion in a hack that started with a fake job interview. The exchange describes the attackers as North Korea-linked. By its account, they spent months compromising employees and internal systems before they carried out the exploit.
A job interview as the way in
The entry point wasn't a software bug. It was a person. According to Binance, the attackers used a fake job interview to compromise the exchange's employees, which is a social-engineering play rather than a technical break-in. No exotic zero-day was needed to get a foothold, just a believable pitch and someone willing to take the call.
That detail matters because it's the part of the story an exchange can't patch with a software update. Staff training and internal access controls are what stand in the way here.
Months inside before the exploit
This wasn't a smash-and-grab. Binance says the attackers spent months compromising employees and internal systems ahead of the exploit itself. Plural employees, plural systems. The picture is of a slow, patient intrusion that widened step by step, not one stolen laptop.
The exchange hasn't said, at least in the account available so far, how many staff were affected or when the compromise first began. Those are the numbers that would show how long the attackers were able to operate unnoticed.
The hot-wallet signing layer
The target was Binance's hot-wallet signing infrastructure. Hot wallets are the connected wallets an exchange uses to move funds out quickly, and the signing systems are what authorize those transfers. Control that layer and you don't have to break the wallets. You can get them to approve the transactions for you.
That fits the months of groundwork. Reaching signing infrastructure generally means getting through people and internal systems first, which is exactly the path Binance says the attackers took.
Where EIP-7702 comes in
The exploit used Ethereum's EIP-7702 mechanism, according to the exchange. It's a relatively recent addition to Ethereum, and its appearance in a hack of this size will draw attention from other platforms that rely on it. The available facts don't spell out how the attackers used it, and it would be a guess to say more.
What they do establish is the combination. A human-level compromise got the attackers inside, and an Ethereum-specific mechanism was part of the exploit itself.
What Binance hasn't said
The $6.3 billion figure comes from Binance, and so does the North Korea link. The attribution is the exchange's description of the attackers, not a finding from an outside investigator, and it should be read that way until someone else weighs in.
Several basics are still missing. There's no breakdown of which assets were taken. There's no word on whether any funds have been frozen or recovered. There's no timeline for when the exploit was carried out. Binance's full technical account of how the signing infrastructure was reached, and how EIP-7702 was used against it, is the next thing to look for.
