Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third’s computer to drain $6.3 billion worth of crypto in last week’s record heist, the exchange said on Tuesday.
In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking endeavour that began in June and set off a series of security breaches culminating in the theft on Thursday.
Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Thursday, the hackers were still making off with crypto from the exchange nearly four hours after the first theft, Binance said.
The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers whose funds were stolen.
The attack has raised questions about how hackers breached the world’s largest crypto exchange after years of North Korea-linked attacks, which have grown in ambition and frequency, and renewed questions about the vulnerability of digital assets to cybercrime.
Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Fake job interviews are a well-known hacking technique.
Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. That shows Binance is “just getting barraged,” Barnhart said.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its report.
Left Exposed
Binance said the attack began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with. The exchange said it detected this afterwards, replaced the device and changed credentials, but the employee’s role and those of others on the wallet team were exposed.
A person familiar with the incident said the tool’s malicious version had been placed in an advertisement, which meant it appeared higher in a search engine than the real version.
Then in September, a second software engineer seeking a new job downloaded a “malicious code repository” onto the person’s computer after interviewing for what they thought was a legitimate role, including meeting virtually with the CEO of a fictitious company, Binance’s report said.
On October 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer’s system and that of a second wallet developer.
Nine days later, the attacker used the second wallet developer’s computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
A limited number of engineers at the company have direct access to wallets — which store or trade crypto — the person familiar with the hack said.
Crypto Removed In Minutes
The attack unfolded quickly on October 29, removing 233.46 million XRP — a cryptocurrency — from five Binance hot, or internet-connected, wallets to an attacker-controlled address in just four minutes, before attackers withdrew other cryptocurrencies including bitcoin, the exchange said in its report.
Binance said it received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised permissions, resulting in about $2.85 billion of frozen assets, but suspending withdrawals alone could not stop all unauthorised asset movements.
Attackers used 50 signing transactions to manipulate the account, while Binance said it was forced to build new procedures to revoke authorisations, slowing its response.
The final unauthorized transfer was at 2356 GMT, Binance said, nearly four hours after the attack began.
Binance said as a result of the hack, it was increasing investment in AI-enabled detection and working on establishing a security research fund and targeted initiatives with leading AI companies.
(Reporting by Elizabeth Howcroft in Paris, AJ Vicens in Detroit and Hannah Lang in New York; Editing by Tommy Reggiori Wilkes and Rod Nickel)
