Skip to main content
BitCurrent

Crypto markets, protocols and policy

Binance says fake interview enabled $6.3B hack

Binance says attackers used a fake recruitment process and internal AI tool in a months-long breach; $2.85 billion in assets have been frozen so far.

BitCurrent Newsroom2 min read

Binance says fake interview enabled $6.3B hack

Binance says attackers used a fake recruitment process and an internal AI tool to reach systems involved in its estimated $6.3 billion theft. The exchange’s account describes a months-long campaign against employees and wallet infrastructure.

  • Estimated impact: about $6.3 billion.
  • Assets frozen or intercepted: about $2.85 billion.
  • Impacted assets replenished by Binance: 98%.

In an incident report covered by The Block on Nov. 3, Binance said the attackers used malware and stolen credentials to access wallet-signing systems and authorize unauthorized transactions.

How did the attackers get inside Binance?

Binance said a tampered Homebrew installation compromised one engineer’s device in June, but the exchange detected the anomaly, replaced the device and rotated credentials. In September, another employee was targeted through a fraudulent recruitment process.

The attackers posed as company executives and got the employee to download a malicious coding assignment. On Oct. 20, they used the compromised computer and an internal AI tool to reach two other engineers’ devices. Nine days later, they deployed a container and ran a malicious script, Binance said.

What is confirmed about the theft and attribution?

Binance estimates the total impact at around $6.3 billion. The FBI separately attributed the theft to North Korea’s TraderTraitor activity, saying more than $6 billion in virtual assets was stolen on or about Oct. 29.

The FBI said it had observed stolen assets being converted primarily into Ether. Binance said it had frozen or intercepted about $2.85 billion and replenished 98% of affected assets with company funds.

What remains open about the breach?

Binance said its investigation found social engineering, malware and compromised internal AI tooling, and that it had rebuilt or replaced affected systems and strengthened controls. The exchange has not publicly identified all the breach points or explained the full technical path from employee devices to wallet transactions.

The FBI’s attribution establishes its assessment of who was responsible; it does not settle every detail of how the attackers operated. Binance said it would commission an independent cybersecurity review.

Source material