Binance has published a preliminary investigation into the theft of about $6.3 billion from its platform. It says North Korea-linked hackers began with a fake job interview aimed at one of its engineers. A tampered file on a work laptop then gave the attackers a route into the exchange's wallet systems. The report is the most detailed account yet of how the heist unfolded.
Binance released the report and described a 'sophisticated, multi-stage campaign' that combined fake recruitment interviews, malicious downloads, a compromised internal AI tool, endpoint compromise and an advanced transaction-authorisation method. Co-CEO Richard Teng said on X that the full report was being published because the lessons go well beyond Binance. Binance puts the loss at roughly $6.34 billion, and says it is still investigating with independent security firms reviewing its findings.
An earlier warning in June
According to the report, the groundwork began months before the theft. In June, a wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool he had found through a search engine. Binance's security team spotted the anomaly, replaced the device and rotated the related credentials. By then, the attackers had learned who the engineer and his colleagues on the wallet infrastructure team were. Fortune reports the attacker also found that the engineer held a container deployment permission token on his machine.
The fake recruiter
In September, a second engineer was approached through a legitimate job-hunting platform. His profile there referred to his time at Binance. The contact posed as a project director and set up two rounds of interviews.
The first was a live video call with a supposed HR representative. The interviewer shared a social media account full of personal photos and videos to build trust. Binance said the approach was more convincing than social engineering it had seen before. The second round took place on a popular chat app with someone claiming to be the CEO of a fictitious company.
The coding test
Near the end of that interview, the engineer was told to download an "assignment" onto his work computer. It contained a malicious code repository that ran during setup. The report says the malware swapped a legitimate development tool component for a malicious one, contacted an attacker-controlled server and erased evidence of its activity. Binance said the zero-day malware went undetected by its endpoint security tools at the time.
Four hours on October 29
The attackers used that foothold, plus access to internal AI tooling, to reach Binance's wallet-signing infrastructure and authorise transactions. The attack ran for about four hours on October 29, and the FBI attributed it to North Korea-affiliated hackers. The Epoch Times reports that the FBI named the actor known as TraderTraitor.
Recovery and denial
Binance said it has frozen or intercepted about $2.85 billion in assets and replenished 98% of the affected assets. The remainder involves thinly traded tokens that are harder to buy.
Pyongyang rejects the attribution. Kim Jong-un's sister called the FBI's claims a "grave political provocation."
Binance said it detected and stopped 57 suspected North Korea-linked threats in 2026, including fake job interviews, malware disguised as developer tools, tainted software packages, fake video-conferencing apps and credential-theft schemes. The approach resembles the known North Korean campaigns Contagious Interview and Operation Dream Job, though Binance has not tied the breach to either.
