Binance says the theft took months. The cryptocurrency exchange has revealed how fake job interviews, malicious software, compromised devices, and an internal AI tool led to a $6.34 billion loss in digital assets. The FBI has attributed the attack to North Korea, which Binance called a “sophisticated, multi-stage campaign.”
The theft took place on October 29, but Binance’s account shows that attackers had been preparing for months. Richard Teng, Binance’s CEO and co-chief executive officer, described it as a “months-long campaign” and “one of the most sophisticated attacks the digital asset industry has ever seen.”
The attack started with developer tools
In June, a Wallet DevOps engineer working on Binance’s wallet infrastructure downloaded a tampered Homebrew installation for a popular AI coding tool. The engineer found it through a search engine, and the postmortem said the installer was apparently spread by a malicious Google ad.
Binance detected that first malware installation and replaced the worker’s device. The incident still exposed information about the engineer’s colleagues and how they worked, giving the attackers material for the next stage. Security teams had stopped the first installation, but the attackers had already learned enough to keep going.
In September, a software engineer received a message from a “Project Director” through a legitimate job-hunting platform. He completed two rounds of interviews: the first took place over live video with a supposed HR Representative, who shared a personal social media account to build trust, and the second happened through a chat app with the supposed CEO of a fictitious company.
The fake CEO sent an assignment for the engineer to download. The file contained malware that executed during setup, and Binance said the malware “employed sophisticated obfuscation and evasion techniques” to escape detection.
Malware, AI, and a wallet that could not stop instantly
The malware replaced an authentic development tool component with a malicious version that could execute commands and establish communication with an attacker-controlled external server. It also concealed its activity and removed traces of the compromise, while Binance said its endpoint security tools did not detect the 0-day malware at the time.
Binance said the attackers then used the compromised software engineer’s computer and an internal AI tool to gain control of the Wallet DevOps engineer’s computer and another engineer’s device on October 20. On October 29, they logged into the third engineer’s computer, used credentials stolen from the first Wallet DevOps engineer, and triggered a malicious script that launched the theft.
The FBI identified the attackers as a North Korean unit called “TraderTraitor,” also known as the Lazarus Group. Binance said the latest information from the FBI indicated that the Democratic People’s Republic of Korea was responsible, while North Korea denied the accusation; Kim Yo Jong called it another “sinister attempt” by the United States to damage the country’s public image.
The incident affected $6.34 billion worth of digital assets, with $2.85 billion frozen or intercepted. Binance said asset movement continued after it suspended withdrawals because those transactions had already been authorized, and the exchange could not immediately revoke the malicious EIP-7702 authorizations.
That limitation came from the hot wallet’s Multi-Party Computation system, Binance said. “Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.” A system designed to avoid one private key did not provide an instant undo button. Security remains stubbornly resistant to product metaphors.
Binance promises to absorb the loss
Binance suspended customer withdrawals globally while it responded to the attack, then restored the service on Sunday. Customers withdrew billions of dollars worth of assets after withdrawals reopened, and Richard Teng said, “Withdrawals have broadly resumed.”
As of November 3, Binance had rebuilt its affected wallet system and internal AI tools, replaced affected devices, decommissioned compromised credentials and tokens, and completed enhanced security scans on employee devices. The exchange also added AI-powered anomaly detection capabilities, plans to work with third-party cyber experts, and said it would increase investment in AI tools that detect security threats.
Binance said it would absorb the financial losses and had set aside more than 100% of the funds needed to cover the stolen assets. It had replenished 98% of the affected token assets and was purchasing the remaining, more illiquid assets.
The company also said it had prevented 57 suspected North Korea-linked cyber threat cases. The attack remains the largest crypto theft to date, and its lesson is unpleasantly clear: the wallet was not breached by one dramatic mistake, but by a chain of trusted tools, trusted devices, trusted credentials, and one very fake job.
Based on
- Binance attackers used fake job interviews to pull off $6.3 billion crypto heist — engadget.com
- How Fake Job Interviews Helped Hackers Steal $6 Billion From Binance – Business Insider — businessinsider.com
- Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist | The Verge — theverge.com
- Binance hackers used fake job interviews in record heist – The Japan Times — japantimes.co.jp
- Binance says fake job interviews used as part of $6.3bn crypto hack — bbc.com
