Binance has disclosed how attackers used fake software downloads, fraudulent job interviews and compromised internal tools to breach its wallet infrastructure in an October 29 cyberattack that resulted in the theft of more than $6 billion in digital assets.
The incident was not caused by a single employee mistake, Binance co-CEO Richard Teng told CNBC’s “Squawk on the Street”. Instead, attackers spent months building access before reaching the system responsible for authorising wallet transactions.
Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram
“They spent months building their way in,” Teng said, describing a sequence involving a compromised developer tool, malware hidden in a coding exercise and access to internal AI systems.
How Attackers Reached Binance’s Wallet Infrastructure
According to Binance’s security report, the operation began in June when a Wallet DevOps engineer downloaded a modified Homebrew installation while searching online for a popular AI coding tool.
Binance detected suspicious activity, replaced the engineer’s device and rotated credentials. However, the company said the engineer’s role and the work of colleagues on the wallet infrastructure team had already been exposed.
In September, attackers allegedly posed as recruiters and interviewed another engineer. A coding exercise contained hidden malware designed to evade security controls, Teng said. The attackers subsequently moved through internal AI tools and gained access to the system authorising wallet transactions.
Teng did not directly attribute the attack to North Korea, but said the FBI had linked it to North Korean hackers associated with the TraderTraitor group.
Binance Recovers Most Affected Assets
Binance said it has replenished 98% of the $6.34 billion in affected assets and is working to acquire the remaining, less-liquid holdings. The exchange temporarily restricted certain withdrawals, committed to covering customer losses and used its reserves to restore affected funds.
The company and industry partners, including Tether, Circle and Ripple, have reportedly frozen around $3 billion in assets. However, some stolen funds continue to move through laundering channels.
Coinbase has also blocked transfers to compromised wallets and offered assistance to Binance.
Security Overhaul And Industry Confidence
Following the breach, Binance rebuilt the affected wallet system and internal AI tool, replaced compromised devices, revoked credentials and tokens associated with the engineers involved, and expanded security scans across employee devices.
The exchange has also commissioned an independent expert to review its response and security measures. Teng said Binance would continue strengthening its defences while working with law enforcement and industry partners to trace and freeze the stolen funds.
The incident has renewed questions about the security of centralised crypto exchanges. Although Binance maintains that it remains financially sound, attention is now focused on recovering the remaining assets and demonstrating that its security controls can withstand increasingly sophisticated attacks.
