Binance has blocked 57 suspected North Korea-linked cyberattacks so far in 2026, Chief Security Officer Jimmy Su said in a fireside chat with co-CEOs Yi He and Richard Teng. He also explained how the attack that got through began with a fake job interview. The executives used the session to answer community questions about the October 29 security incident and to outline how Binance is strengthening its defenses.“We stopped 57 of these attempts. We did not stop them all,” Su said, calling it “the reality every major platform now lives with.”A Targeted, Months-Long SetupThe attack started in September, when a Binance software engineer was contacted on a legitimate job-hunting platform by someone posing as a project director. The approach referenced his experience at Binance. “The approach was targeted, not random,” Su said.First interview: A live video call with a fake HR representative, who shared a social media account with personal photos and videos to build trust. Su called this “more advanced and deceptive than social engineering we have seen before.”Second interview: A popular chat app, with someone claiming to be the CEO of a made-up company. At the end, the engineer was told to download a coding assignment onto his work computer. The code repository contained malicious code that ran during setup.The malware replaced a legitimate development tool component with a malicious version, which let it run commands and talk to an attacker-controlled server. It was zero-day malware, meaning previously unknown, and Binance’s third-party endpoint protection did not catch it at the time. The attackers also hid their activity and removed traces.“This was not a cold scam. It was a patient operation,” Su said. “Human-targeted attacks are the hardest risks any organization faces, not just in crypto but everywhere.”Why Pausing Withdrawals Was Not EnoughSu explained why funds kept moving for a time after Binance detected the attack. The attacker had set up an onchain authorization, which Binance’s initial report identified as an EIP-7702 delegation. It worked independently of Binance’s withdrawal systems.“Pausing withdrawals was necessary, but it was not sufficient on its own,” Su said. Binance needed separate onchain transactions to revoke the authorization.Binance’s hot wallet uses multi-party computation (MPC), which splits control of a wallet across several parties so there is no single private key. That is a security feature, but it also meant there was no one key to revoke the authorization instantly. The team had to build and run a special revocation procedure under extreme time pressure, which is why containment took hours rather than minutes.“We are sharing it openly because any platform using similar architecture needs to understand this failure mode before they face it,” Su said.Yi He: “We Should Be Honest”Yi He said Binance’s senior legal counsel and other senior leaders advised against publishing so much detail. “I fully rejected it,” she said.“We believe honesty will build trust between the community and Binance,” she said. “We are definitely not perfect, but if sharing more detail can help other players in the industry understand what happened, how it happened and how to improve themselves, I think that’s still valuable.”She described AI as both “the spear and the shield”: attackers use it, and Binance uses it to rebuild and defend its systems. She added that Binance’s HR team regularly spots and rejects suspicious job applicants who try to join the company.What Binance Has Fixed and What Comes NextBy November 3, Binance had completed several key security measures, Su said. It also improved its AI-based anomaly detection, tightened risk controls around its wallet services, and worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.Binance is now making deeper changes to its security architecture. These include stricter separation of internal and external network traffic, better isolation of sensitive data, and separation of file storage and network access on company devices. “Even if a single employee device is compromised, that compromise should not be able to escalate into a systemic security incident,” Su said.He named three priorities:Independent review: External security experts will review the incident and check Binance’s findings. “We don’t want to simply review our own work and declare that everything is secure,” Su said.AI security: More investment in AI-enabled threat detection, endpoint protection and developer-environment security. Su said internal AI tools and developer environments “need to be treated as critical infrastructure.”Industry collaboration: A planned security research fund with leading AI companies, security firms and other industry participants, focused on AI-related threats in blockchain.Building for the Long TermYi He said Binance will also rebuild its risk control, security and technology teams, just as it rebuilt its compliance team after past challenges. She pointed to the exchange’s growing TradFi and real-world asset (RWA) business as part of its long-term direction. She said Binance plans to hold more open AMAs so users can ask questions directly.
Weatherly
Anais
Catherine
Kikyo