Binance Traces Its Hack to a Fake Job Interview

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Binance traced its hack to a fake job interview
• The CFTC cleared single-stock perps; Cboe's group sued
• Kraken restricted accounts over a $133M theft
• SEC staff called Canton Coin a digital commodity
• Ethereum eyes a post-quantum switch by 2028

Binance says the attack that cost it about $6.34 billion started with a job interview. In a technical report published today, it said a recruiter on a legitimate job site approached one of its engineers in September. After a first video interview, a person posing as a company CEO told him in a second interview to download a coding assignment onto his work computer. The code replaced a development-tool component and hid from Binance's security software.

The attackers then moved from one engineer to the next. On Oct. 20, they used that computer and an internal AI tool to reach two wallet engineers. On one of their machines, they found a credential that could deploy software. On Oct. 29, they used it to run a script inside Binance's wallet-signing service. That service signed the EIP-7702 delegation that let an outside contract empty a hot wallet. Co-CEO Richard Teng called it "a months-long campaign."

The report also corrects Binance's first account, which said outflows stopped when it paused withdrawals. The delegation sat onchain, outside the withdrawal system, so the pause did not cancel it. Binance signs with multiparty computation, so no single key could revoke the permission quickly. Its team built a procedure and cleared the delegation at 8:10 p.m. ET on Oct. 29. By our arithmetic, that was 3 hours and 46 minutes after the first sweep. Onchain records showed the gap on the day: a second sweep at 5:04 p.m. ET moved another 1,700 ETH after Tether had frozen the receiving address.

Binance also paid for the attack itself. It had no cyber insurance, according to a person familiar with its business. The money came from its SAFU emergency fund, its treasury and its futures insurance fund. Despite its name, that fund is an internal reserve built partly from liquidation fees. Binance now says about $2.85 billion has been frozen or intercepted, below the roughly $3 billion it cited on Oct. 30. It says the figure is still subject to reconciliation and price changes.

No step in the attack broke any cryptography. Each one used a person, a laptop or a tool that Binance trusted. The attackers spent weeks inside the company before they touched a wallet.

Read more below!

As of 23:28 UTC, Nov. 3. Data: CoinGecko, Aave, Hyperliquid. Full list

WATCH

THORChain Refused to Block the $387M Bitget Hacker. Here’s Why | Chad Barraford

Chad Barraford, THORChain's technical co-founder, explains why THORChain did not block the hacker behind Bitget's $387 million theft. The FBI has since asked THORNode operators to block funds from the Binance hack. Listen to the episode or watch below.

HACKS

Binance Details Months-Long Campaign Behind $6.34 Billion Hack

Binance said the campaign started earlier: in June, a wallet engineer installed a tampered copy of Homebrew while looking for an AI coding tool. Binance caught it, replaced the device and rotated credentials, but the attackers had already learned who worked on wallet systems. Binance says it has rebuilt the wallet system and the AI tool and hired outside experts to check its findings. Teng said withdrawals have broadly resumed, and Binance's tracked wallets swung back to net inflows. Another reserve snapshot covering more tokens is due Wednesday.

Binance Details Months-Long Campaign Behind $6.34 Billion Hack

thedefiant.io

REGULATION

CFTC Chair Says Equity Perps Can Begin US Trading

CFTC Chairman Michael Selig said single-stock perpetual futures can begin trading on U.S. exchanges that are also registered with the SEC for security futures. The contracts track a stock's price without expiring and without share ownership. Applications from Coinbase Derivatives, KalshiEX and Bitnomial were deemed approved after the CFTC's 45-day review passed without a rejection. The Capital Markets Alliance, whose members include Cboe and Citadel Securities, sued to overturn the approvals. It argues the contracts are security-based swaps for the SEC and asks for a restraining order.

HACKS

Kraken Restricts Accounts Amid Suspected $133 Million-Plus EU Theft

Kraken restricted accounts while it investigates reports that funds from a suspected EU theft moved through them. ZachXBT now puts the theft above $133 million and says it did not start at Kraken. Chainalysis put the Mercado Bitcoin hack at $49 million across 17 chains, with nearly $10 million frozen, and the exchange promised customers no losses. GitBook revoked all personal API tokens after a breach. Backpack warned of fake stock-token airdrops, and our guide covers what to check before paying a recovery service.

REGULATION

SEC Staff Grants Canton Coin No-Action Relief for Token Minting

SEC staff granted no-action relief for minting Canton Coin and called it a “digital commodity.” Validators and app providers mint the token based on network activity, and fees burn it. The relief rests on Digital Asset's representations and is not a legal ruling. On Canton, Société Générale accepted $10 million in DTCC-tokenized Treasuries as collateral. Amazon, Tesla and SpaceX joined the OKXICE objectors, bringing the total to 56, and Bullish added Aptos and Ethereum to its stock tokenization service.

BLOCKCHAINS

Justin Drake Targets December 2028 for Ethereum’s Post-Quantum Transition

Justin Drake set December 2028 as a goal for Ethereum's full post-quantum transition, at Devcon 8's opening. That is faster than the Ethereum Foundation's published 2029 target and would take three more forks after Glamsterdam. A large enough quantum computer could recover private keys from exposed public keys. Elsewhere, Aztec launched its Tierra upgrade, Sei's Autobahn vote cleared quorum, and Stellar's Bell upgrade went live on testnet ahead of a Nov. 23 mainnet vote.

Other Stories Worth Your Time

Liquid Restores Full Bitcoin Backing After Elements Exploit — a 250 BTC transfer closed the gap left by the Sept. 6 exploit.

Kalshi’s Tradable Midterms Index Settles to Pyth Values — Pyth publishes the values that decide payouts.

France Delays Budget Vote Again, Leaving Stablecoin Tax Pending — the tax would hit gains on crypto-to-stablecoin swaps.

BitGo Adds Stacks Bitcoin Staking in Qualified Custody — clients earn BTC rewards without moving coins out of custody.

What Are Euro Stablecoins? EURC, EURR and Redemption Explained — a €1 target and a route back to a bank are different things.

Trending on The Defiant