Binance details $6.3B heist method
The exchange says North Korean hackers used fake interviews and malicious code to steal billions.
By Luka Evans ·
Binance Holdings Ltd. revealed on Tuesday that the theft of $6.3 billion resulted from a long-term campaign rather than a single error. The company identified North Korean actors as the perpetrators in a detailed report released after the incident first surfaced on Oct. 29.
The attackers targeted one of Binance’s engineers through a job hunting platform. The individual posing as a recruiter contacted the employee about a role with a fictitious company. The engineer then participated in an interview over a social chat app with a person claiming to be the chief executive officer of that fake entity.
During the interview, the candidate was asked to download an assignment file. This file contained a malicious code repository. Once installed, the code triggered a series of unauthorized activities within the company’s systems.
Richard Teng, co-chief executive officer of Binance, described the operation as a sophisticated, multi-stage campaign. He stated that the group combined fake recruitment interviews with malicious software disguised as legitimate developer tools. The attackers also used compromised devices and artificial intelligence techniques to execute the plan.
The timeline of the intrusion began months before the final theft. Nine days prior to the hack, the attackers tapped into the laptop of the targeted engineer. This access allowed them to infiltrate the computers of two other software engineers who worked on Binance’s digital wallets.
One of those two engineers had previously downloaded malicious software in June. The engineer intended to install a popular AI coding tool but inadvertently exposed the roles of their colleagues to the hackers. This early exposure allowed the attackers to map out the internal structure of the wallet team.
The exchange stated that the hackers used an internal AI tool to gain control of the employees’ laptops. The report did not specify the exact nature of this tool or the precise mechanism used to compromise the devices.
In the immediate aftermath of the hack, Binance paused withdrawals for nearly two days. The company began allowing users to withdraw funds early on Sunday. By Tuesday, the company reported that hourly deposits had started exceeding hourly withdrawals. Binance said it has almost replenished the stolen cryptocurrency using corporate treasury funds and two insurance funds.
The company is working with the Federal Bureau of Investigation, the US Secret Service, and the Justice Department. The FBI also attributed the breach to North Korean hackers. Binance reported that it identified and prevented 57 attempted attacks from North Korea-connected hackers in 2026.
The financial market reacted with limited volatility to the news. Bitcoin dropped by more than 4% to nearly $76,000 immediately after the exploit was reported. By Tuesday, the price had recovered to trade at approximately $77,200.
