Binance has published an initial security report detailing how hackers used a fake job interview and tampered software to compromise engineer computers and steal $6.3 billion in cryptocurrency on October 29. The exchange said it is repaying all affected customers and has frozen about $2.85 billion in assets. The FBI has attributed the attack to a North Korean hacking group, a claim Pyongyang rejects.
How the breach began
According to the report, the operation started in June when an employee on the wallet developer team downloaded a tool that hackers had tampered with. Binance detected the problem afterward, replaced the device, and changed credentials. However, the employee’s role and those of other wallet team members remained exposed. The report describes a multi-stage operation that built up over several months.
A person familiar with the incident said the malicious version of the tool sat inside an advertisement, causing it to appear higher in search results than the legitimate software. In September, a second software engineer downloaded a malicious code repository after a job interview. The candidate believed the role was legitimate, and the interview included a virtual meeting with the CEO of a fictitious company. Michael Barnhart, a researcher at cybersecurity firm DTEX, said fake job interviews are a well-known hacking technique.
From compromised computers to the theft
On October 20, the attacker used a compromised computer and an internal AI tool to gain control over the wallet developer’s system and that of a second wallet developer. Nine days later, the attacker used the second developer’s computer, with stolen credentials from the first developer helping to trigger a malicious script.
The attack unfolded quickly on October 29. Attackers moved 233.46 million XRP from five hot wallets to an attacker-controlled address within four minutes. They later withdrew other cryptocurrencies, including bitcoin. Few engineers at the company have direct access to wallets, according to a person familiar with the matter. Binance said the attackers used 50 signing transactions to manipulate the account.
Binance’s response
Binance received an internal alert about large transfers and began investigating. The exchange suspended withdrawals, froze affected tokens, and removed unauthorised permissions, leaving about $2.85 billion in frozen assets. However, suspending withdrawals alone could not stop every unauthorised movement. Binance also had to build new procedures to revoke authorisations, which slowed its response. The final unauthorised transfer took place at 2356 GMT, nearly four hours after the attack began.
Binance apologised to users, partners, and the wider industry, stating in its report: “This should not have happened.” The exchange said it prevented 57 suspected North Korea-linked cyberthreats in 2026. Barnhart said Binance is “just getting barraged.”
Binance said it is increasing investment in AI-enabled detection and is working on a security research fund and targeted initiatives with leading AI companies.
