Binance has disclosed more details about how a hacker gained access to its wallets, saying the attacker used malicious code delivered during a fake job interview to socially engineer one of its software engineers. The exchange also outlined the steps it has taken since the $6.3 billion heist to rebuild its internal security systems.
How the attack unfolded
In an X post, Binance said the hackers ultimately reached its wallets after getting a software engineer to download malicious code during a fake job interview. The code was used during the setup process and triggered a series of unauthorized activities, according to the exchange.
Binance said the malware employed sophisticated obfuscation and evasion techniques, which helped it go undetected until the hack. The exchange added that its subsequent investigation was also challenging because of those evasion techniques.
Binance said the hacker infiltrated its organization as far back as June 2026, when a Wallet DevOps engineer downloaded a tampered Homebrew installation to install a popular AI coding tool after searching for it on a search engine.
The exchange said its security team detected the breach and took steps to address it. By then, however, the hacker already knew the engineer’s role and who else was on the wallet infrastructure team.
Binance said the attacker used the software engineer’s computer, where the malware had been downloaded during the fake interview, along with an internal AI tool, to gain control of the Wallet DevOps engineer and another wallet software engineer. The attacker soon discovered that the Wallet DevOps engineer had a container deployment permission token on his computer, Binance added.
Security and recovery steps
Since the hack, Binance said it has rebuilt the affected wallet system in a new environment and decommissioned credentials and tokens related to the affected engineers.
The exchange said it completed enhanced security scans across all employee devices and enhanced its AI-based behavioral anomaly detection as part of its effort to tighten security.
Binance is also working with law enforcement, blockchain intelligence firms and industry partners to trace and freeze the remaining stolen assets. The exchange estimates that partners including Tether and Circle have helped freeze nearly $3 billion out of the $6.3 billion stolen.
Binance said withdrawals have resumed and that it has replenished almost 100% of the stolen assets. Binance founder Changpeng “CZ” Zhao said the company covered the loss without seeking financial help from external entities.
