Binance’s first incident report traces the record theft back to a tampered download in June and a bogus recruiter in September.
Hackers used a fake job interview and software hidden in an advert to compromise the computers of two Binance software engineers, Binance said on Tuesday.
A third engineer’s computer was then used to drain $6.3 billion worth of crypto from the exchange on 29 October. EM360Tech earlier reported on the theft.
The report is the exchange’s first detailed account of how the attack happened. It describes a multi-stage operation that began in June.
The FBI has blamed a North Korean hacking group. North Korea has rejected the claim.
Groundwork Before the Theft
Binance said the attack began in June, when an employee on its wallet developer team downloaded a tampered tool from the internet. The exchange said it detected the problem, replaced the device and changed credentials. The employee’s role, and those of others on the wallet team, were still exposed.
A person familiar with the incident told Reuters the malicious version of the tool had been placed in an advert, so it appeared higher in search results than the genuine one.
In September, a second engineer who was looking for a new job downloaded a “malicious code repository” after an interview for what they believed was a legitimate role. The process included a virtual meeting with the CEO of a fictitious company, according to the report.
On 20 October, the attacker used that compromised computer and an internal AI tool to take control of a wallet developer’s system and that of a second wallet developer. Nine days later, the attacker used the second developer’s computer, with credentials stolen from the first, to trigger a malicious script.
Wallets Drained in Four Minutes
The attack removed 233.46 million XRP from five Binance hot wallets in four minutes. Hot wallets are connected to the internet. The attackers then withdrew other cryptocurrencies, including bitcoin.
Binance said it received an internal alert about large transfers, suspended withdrawals, froze affected tokens and removed unauthorised permissions. That left about $2.85 billion in frozen assets, but the exchange said suspending withdrawals alone could not stop every unauthorised movement. Withdrawals then slowed in the days after the hack.
The attackers used 50 signing transactions to manipulate the account. Binance said it had to build new procedures to revoke authorisations, which slowed its response. The final unauthorised transfer came at 2356 GMT, nearly four hours after the attack began.
North Korea Link Disputed
The FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible, according to ABC News. It also said it expects further laundering stages for the stolen assets.
North Korea has denied involvement. Kim Yo Jong, sister of leader Kim Jong Un, called the accusation a “grave political provocation”, CNBC reports, citing state media.
Michael Barnhart, a researcher at cybersecurity firm DTEX, said fake job interviews are a well-known hacking technique. Binance said it detected and prevented 57 suspected North Korea-linked threats in 2026, which Barnhart said shows the exchange is being constantly targeted.
Binance has said it is repaying all customers whose funds were stolen. In its report, it said the incident “should not have happened” and apologised to users, partners and the wider industry.
The exchange said it is increasing investment in AI-enabled detection. It is also working on a security research fund and targeted initiatives with leading AI companies.
Comments ( 0 )