Hackers spent months infiltrating Binance through fake job interviews, malicious software and compromised internal tools before stealing $6.34 billion in cryptocurrency from the world’s largest crypto exchange, according to a security report released by the company on Tuesday.
The October 29 attack targeted computers belonging to three software engineers, eventually giving attackers access to systems responsible for authorizing wallet transactions. Binance’s investigation revealed a coordinated operation that began with a compromised software download in June, escalated through a fraudulent recruitment campaign in September and culminated in one of the largest crypto heists on record.
The incident highlights how cybercriminals are increasingly exploiting employees and trusted workplace tools to penetrate even sophisticated financial platforms.
Fake software and job interviews opened the door
According to Binance, the first breach occurred in June when an engineer on its Wallet DevOps team downloaded a tampered version of Homebrew, a popular software package manager, while searching online for an AI coding tool.
The malicious installer had reportedly been promoted through an online advertisement, allowing it to appear higher in search results than the legitimate software.
Binance detected the suspicious activity, replaced the affected device and changed the employee’s credentials. However, attackers had already obtained information about the engineer’s role and colleagues responsible for the exchange’s wallet infrastructure.
In September, hackers targeted a second software engineer through what appeared to be a legitimate recruitment opportunity on a job-search platform.
The employee participated in a video interview with a supposed human resources representative, followed by another interview through a messaging application with someone claiming to be the chief executive of a fictitious company.
During the process, the engineer was asked to complete a coding assignment by downloading a repository containing hidden malware designed to evade security detection. This gave attackers another foothold inside Binance’s systems.
Binance hackers used fake job interview in $6.3 billion attack
Internal AI tools helped expand access
The attackers subsequently used the compromised computers to move deeper into Binance’s infrastructure.
On October 20, they combined access to the infected computer with an internal AI tool to gain control of the systems of two wallet developers.
Nine days later, hackers used the second developer’s compromised computer, alongside credentials stolen from the first engineer, to deploy a malicious script and initiate the attack.
Binance co-CEO Richard Teng said the breach was the result of a months-long operation rather than a single security failure involving one employee.
Speaking to CNBC, Teng explained that attackers first compromised an engineer through a tampered developer tool before using a fake recruitment process to target another employee. They then exploited internal AI tools to reach systems responsible for authorizing wallet transactions.
The incident also raises questions about the security risks associated with AI adoption in corporate environments. While internal AI applications can improve productivity, compromised employee accounts may turn these tools into pathways to sensitive infrastructure.
$6.34 billion stolen in a matter of minutes
The final stage of the operation unfolded on October 29, when attackers exploited unauthorized access to Binance’s wallet transaction-signing system.
According to the report, hackers transferred 233.46 million XRP from five Binance hot wallets within approximately four minutes, sending the cryptocurrency to an address under their control. They subsequently withdrew other digital assets, including Bitcoin and Solana.
Binance received an internal alert about unusually large transfers and began investigating. The exchange suspended withdrawals, froze affected assets and worked to revoke unauthorized permissions.
However, these measures did not immediately stop the attack.
Binance said hackers used 50 signing transactions to manipulate account authorizations through Ethereum’s EIP-7702 mechanism, which allows accounts to delegate certain execution rights to smart contracts.
Because the malicious authorizations operated independently of Binance’s normal withdrawal infrastructure, suspending withdrawals alone was insufficient to prevent further transfers.
The exchange had to develop additional procedures to revoke the permissions. According to its report, the final unauthorized transfer occurred at 23:56 UTC, nearly four hours after the initial theft began.
Binance replenishes 98% of affected assets
Binance said approximately $2.85 billion of the stolen assets had been frozen or intercepted, with assistance from law enforcement agencies and industry partners.
The exchange also pledged to cover all customer losses using its own resources rather than passing the financial impact on to users.
As of October 31, Binance had replenished approximately 98% of the affected assets, Teng said. The remaining portion consists of less liquid cryptocurrencies that the company is still working to acquire.
The exchange has rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices, revoked credentials associated with the targeted engineers and expanded security monitoring across employee devices.
Binance is also increasing investment in AI-powered threat detection, commissioning an independent cybersecurity review and developing a security research fund to strengthen its defenses.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its report.
North Korea attribution remains disputed
The Federal Bureau of Investigation (FBI) has attributed the attack to North Korean hackers associated with the TraderTraitor group, which has been linked to previous cryptocurrency thefts.
North Korea has rejected the allegations. Kim Yo-jong, the influential sister of leader Kim Jong-un, described Washington’s claims as “absurd rhetoric” and accused the United States of attempting to portray Pyongyang as responsible for cybercrime worldwide.
Binance has not independently confirmed the identity of the attackers, although it acknowledged the FBI’s assessment.
The exchange also disclosed that it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026, highlighting the persistent security pressure facing cryptocurrency platforms.
The breach demonstrates how attackers can spend months exploiting seemingly routine workplace activities, from downloading developer software to participating in recruitment interviews. For the wider crypto industry, it reinforces the need to secure not only digital wallets and transaction systems but also employee devices, software supply chains and internal applications.
