Hackers used fake job interviews, malware disguised as an assignment and an internal artificial intelligence tool to steal billions, the company said.
Hackers pulled off a record $6.3 billion cryptocurrency theft against Binance by running fake job interviews and compromising an internal artificial intelligence tool, the exchange disclosed on Tuesday.
According to an investigation postmortem cited by The Verge, the breach unfolded over several months before attackers initiated unauthorized transactions on October 29. Binance stated that attackers compromised employee machines, gained access to company tools and drained digital assets from its hot wallet.
The exchange had temporarily halted withdrawals after the attack before Binance begins restoring withdrawals after $6.3 billion hack on Sunday. Binance maintained that customers won’t carry the financial loss and said it’s using corporate funds and its Secure Asset Fund for Users to make accounts whole.
How the multi-stage attack unfolded
The intrusion started months before the money disappeared, according to company findings. In June, a developer downloaded a tampered installer linked to a malicious Google ad, which exposed operational details about the company’s engineers. Binance said its security teams caught that installation and replaced the device.
In September, attackers targeted another engineer through a legitimate employment site, BBC News reported. Posing as hiring managers, the intruders conducted multiple interview rounds and shared social media profiles with personal photos to gain the worker’s confidence. During a second interview, the engineer was directed to download a fake assignment that contained evasion malware. The program deleted a tool called the pyenv executable and installed a malicious version that opened a backdoor.
By October 20, the attackers used Binance’s internal AI utility to control wallets linked to the first worker and another engineer. Attackers then accessed the third engineer’s laptop on October 29 to carry out the attack. When unauthorized transfers began, Binance could not immediately cancel them because its hot wallet relied on Multi-Party Computation, meaning no single private key existed to revoke the malicious EIP-7702 permissions on the spot.
Asset recovery and market impact
Binance said the incident was a serious security failure and offered an apology for the disruption. “We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company said in a post on X.
Recovery teams, blockchain tracking firms and law enforcement agencies have frozen approximately $2.85 billion to $3 billion in assets, Fox News reported. Stablecoin issuers Tether, Circle and Ripple locked down hundreds of millions of dollars in related funds. The theft initially dragged down prices for bitcoin, ethereum and BNB, though Binance said major cryptocurrencies remain fully backed.
Binance Chief Executive Richard Teng stated that nearly all missing customer tokens have been returned to reserve pools. “At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%,” Teng wrote.
North Korea denies responsibility
The FBI attributed the hack to the North Korean group TraderTraitor, also known as the Lazarus Group. Federal investigators said the stolen tokens were converted primarily into ethereum to be laundered through instant exchange services and decentralized finance networks. Binance noted it has blocked 57 suspected North Korean cyber threat attempts in the past.
North Korea rejected the findings on Tuesday. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, called the accusations a sinister attempt by the United States to damage her country’s image.
Binance said it will hire outside security firms for a full review of the breach, expand funding for AI-based threat detection and create a security research fund alongside AI technology vendors.
