North Korean hackers stole $6.3 billion from Binance using fake job interviews and an internal AI tool

Hackers stole $6.3 billion from Binance on October 29 in the largest crypto theft on record, and the FBI has attributed the heist to North Korea’s TraderTraitor group.

The attack combined fake job interviews, malicious software, and a compromised internal AI tool to infiltrate the wallet infrastructure of the world’s largest crypto exchange. Preparations began in June. Binance has replenished 98% of affected assets and said it is working around the clock with law enforcement agencies and industry partners to trace and freeze stolen funds.

Months of infiltration

In June, an engineer downloaded a tampered Homebrew installer for an AI coding tool after clicking a malicious Google ad that appeared in search engine results. The compromised installer exposed details about the engineer and how the wallet team worked, including the employee’s role and colleagues on the wallet infrastructure team. Binance detected the suspicious activity, replaced the engineer’s device, and rotated credentials as a precaution. The exposure had already happened. In September, attackers posing as recruiters contacted a different engineer on a legitimate job-hunting platform. A person described as a ‘project director’ arranged a first-round video interview with a sham HR representative, followed by a second-round interview on a chat app with the ‘chief executive’ of a fictitious company. The attackers shared social media pages to build trust before sending a coding assignment that contained hidden malware designed to evade security. When opened, the assignment compromised the engineer’s work-issued laptop. That malware deleted the pyenv executable and replaced it with a malicious version that established backdoor access and communication with an attacker-controlled external server. Binance’s security tools did not detect the September malware, which employed obfuscation and evasion techniques to conceal its activity and remove traces of the compromise, making detection and subsequent investigation more difficult.

The attack

On 20 October, the attacker used a compromised computer together with the internal AI tool to gain control of engineers’ systems on the wallet team, reaching another employee whose access extended to systems capable of controlling billions in crypto. On 29 October, the attacker used a developer’s computer with stolen credentials to trigger a malicious script that drained hot wallets. Nearly two hours passed between the first unauthorized transfers and when Binance stopped the transactions. The hot wallet used Multi-Party Computation, so no single private key could immediately revoke the malicious EIP-7702 authorizations.

Recovery and industry response

The remaining 2% of impacted tokens is still being replenished as Binance works to purchase outstanding, more illiquid assets. Approximately $2.85 billion in stolen assets has been frozen or intercepted. Separately, Binance and industry partners including Tether, Circle, and Ripple have frozen about $3 billion in assets, though some stolen funds continue to move through laundered channels. Coinbase blocked transfers to compromised wallets and offered Binance direct assistance. Binance said no user is bearing the loss. The exchange pledged to cover all customer losses, tapping its own reserves to replenish affected assets. Binance maintains that it remains financially sound and focused on identifying the vulnerability, recovering remaining funds, and preventing another attack. Withdrawals have broadly resumed. As of Tuesday, Binance has rebuilt the affected wallet system and the internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with affected engineers, and expanded security scans across employee devices.

A breach that ‘should not have happened’

Binance said in an updated statement posted on X on Tuesday that the attack ‘should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.’ The exchange has brought in or will bring in independent cybersecurity experts to review the incident and said it will keep strengthening its defenses as the investigation continues. Binance said it has faced at least 57 suspected North Korea-linked cyber threat cases, which it said reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The FBI said on Saturday that North Korea was responsible for the hack. Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un, said the allegations proved Washington remained hostile toward Pyongyang. In remarks carried by KCNA, the North Korean state news agency, she called the FBI accusation ‘absurd rhetoric’ and a ‘grave political provocation.’ She said the FBI was trying to brand the DPRK as a ‘cybercriminal state’ and accused the U.S. of misleading international public opinion as if all cybercrimes were North Korean deeds. Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using dossiers of stolen American identities to trick employees into granting access to their systems. Roughly half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters.

Binance co-CEO Richard Teng rejected suggestions of a single point of failure through one employee’s laptop. Teng said the attackers ‘spent months building their way in.’ The hack sparked a sharp but short-lived hit to confidence across crypto markets, especially compared with previous failures at major exchanges. Binance temporarily restricted certain withdrawals following the heist. Investors are now watching whether Binance can fully restore confidence in centralized exchanges.