Binance hackers used fake job interview to compromise computer before $6.3 billion attack

Binance said a North Korea-linked attack that drained $6.3 billion began with a fake job interview used to compromise employees and internal systems over several months. The attackers ultimately exploited the exchange's hot-wallet signing infrastructure through Ethereum's EIP-7702 mechanism, a feature that lets externally owned accounts delegate execution to smart contracts. The disclosure ties the incident to state-sponsored actors and highlights how social-engineering campaigns can reach the signing layer that secures exchange hot wallets. It matters because hot-wallet signing infrastructure is the last line of defense for centralized exchange funds, and the use of EIP-7702 suggests attackers are targeting newer account-abstraction features. Watch for Binance's remediation of delegated accounts and signing controls, plus any on-chain tracing of the $6.3 billion in assets and responses from Ethereum tooling teams to EIP-7702 abuse.