The $6.34 billion theft from Binance relied on a fake job interview, a tampered developer tool and one of the exchange’s own internal AI tools, according to the company’s initial incident report.
In a report published on X on Nov. 3, Binance described the Oct. 29 attack as a sophisticated, multi-stage campaign. “It was not a single isolated breach or a simple phishing incident,” the company said.
The FBI has attributed the attack to North Korea, which has denied involvement.
How the attackers got in
The campaign started in June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool he had found through a search engine.
Binance detected the anomaly, replaced his device and rotated his credentials, but his role and his colleagues on the wallet infrastructure team had been exposed to the attacker.
In September, a second engineer was approached on a legitimate job-hunting platform by someone posing as a project director. After a first-round video interview with a fake HR representative, he was told in the second round to download an “assignment” onto his work computer.
The repository contained malware that replaced a legitimate development tool component with a malicious version and connected to an attacker-controlled server. Binance said the zero-day malware was not detected by its endpoint security tools.
On Oct. 20, the attacker used the second engineer’s compromised computer and an internal AI tool to gain control over two more wallet engineers, and found a container deployment permission token on the first engineer’s computer.
Nine days later, the attacker logged onto one of those engineers’ computers, used the stolen credentials to deploy a container and then triggered a malicious script to launch the attack on Binance’s internal wallet signing service.
Over the next four hours, the attacker drained Binance hot wallets across several networks. Suspending withdrawals wasn’t enough to stop it, because the attacker had also used the signing service to set up on-chain permissions that worked independently of Binance’s normal withdrawal systems. Revoking them took time, and the last unauthorized transfer went through at 23:56 UTC.
A familiar way in
Binance said it had detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques including fraudulent job interviews, malicious software disguised as developer tools and fake video conferencing apps.
Fake hiring has become a common way in for North Korean operators, as CISO Voice reported last week. “Hackers don’t break in anymore; they log in,” Aaron Painter, CEO of identity verification company Nametag, told CISO Voice at the time.
Binance has since rebuilt the affected wallet system and internal AI tool and replaced devices, decommissioned the affected engineers’ credentials and tokens.
It has also expanded AI-based behavioral anomaly detection, and is engaging independent security firms to review the incident.
