Binance says the thieves who drained a record $6.3 billion from the world's largest cryptocurrency exchange got in by posing as recruiters, planting malware in a job-interview coding test and hijacking an internal artificial intelligence tool, according to findings the company released Tuesday.
The report lays out how the Oct. 29 breach unfolded. Binance apologized, calling the episode a serious and highly sophisticated security incident that should not have happened.
We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,
Binance
Co-CEO Richard Teng said Tuesday that the attackers spent months working their way inside, and he rejected the idea that a single employee's laptop was the lone point of failure.
The groundwork began in June, the security report said, when a Binance Wallet DevOps engineer searched online for a popular AI coding tool and installed a tampered Homebrew package. Binance spotted suspicious activity, swapped the device and rotated credentials, but by then the engineer's role and his wallet-team colleagues had been exposed to the hacker.
In September, the attackers approached a different engineer through a legitimate job-hunting platform and staged bogus interviews with fake company representatives, whose social media accounts displayed personal photos to win his trust. In a second interview, he was told to download a coding exercise that concealed malware designed to slip past security.
In October, the hackers used that compromised computer and the internal AI tool to take over the laptops of two more engineers, Binance said. Teng said they ultimately reached the system that authorized wallet transactions.
Recovering the stolen assets
Teng said Binance has replenished 98% of the $6.34 billion in affected assets and is still buying back the remaining, less liquid holdings. The company has tapped its own reserves and pledged to cover all customer losses.
Withdrawals were suspended for customers worldwide and restored Sunday, after which users pulled out billions of dollars in assets. Coinbase blocked transfers to compromised wallets and offered Binance direct assistance.
We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front.
Richard Teng, Binance co-CEO
North Korea denies role
The FBI and Secret Service are helping trace the stolen crypto, and the FBI has linked the attack to North Korean hackers tied to the TraderTraitor group. Binance cited the bureau's findings in a post Tuesday, though Teng did not make the attribution himself.
North Korea denied involvement. Kim Yo Jong, sister of leader Kim Jong Un, called the accusations another sinister U.S. attempt to damage the country's image. TraderTraitor, which also goes by Lazarus Group, was accused of the 2025 theft of $1.5 billion from exchange Bybit, the previous record.
Binance said it has rebuilt the affected wallet system and AI tool, retired credentials and tokens tied to the engineers, widened security scans of employee devices and brought in an independent expert to review its response. It also plans to spend more on AI tools that detect threats and to create a security research fund.
