Binance said North Korean hackers used a bogus job interview, artificial intelligence (AI), and “social engineering” to compromise an engineer’s computer, and took just four minutes to steal $6.3 billion worth of cryptocurrency.
The cryptocurrency exchange, which was hit by the attack on Oct. 29, published details of an initial report into the findings of its initial investigation into the hack.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” Binance said on X on Nov. 3. “It was not a single isolated breach or a simple phishing incident.”
“The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method,” Binance said.
On Oct. 31, the FBI said it had identified a North Korean actor known as “TraderTraitor” as responsible for the Binance hack. TraderTraitor allegedly carried out a $1.5 billion Bybit hack on Feb. 21, 2025.
Earlier on Nov. 3, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the FBI’s claims and called it “absurd rhetoric,” according to state-run news agency KCNA.
Binance said it had investigated the crypto heist and discovered that it began in June, when an employee of the company’s wallet infrastructure department, whom they refer to as “Engineer A,” downloaded an installation of Homebrew—an open-source software package manager—which had been tampered with, in order to install a popular AI coding tool.
“Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action,” Binance said.
However, the company said Engineer A and the rest of the wallet infrastructure team were already exposed to the hacker.
Binance said another employee, referred to as “Software Engineer B” was then head-hunted, and contacted on a legitimate job-hunting platform by an individual posing as a project director for a company that was fictitious.
The so-called project director then arranged a first-round interview with an HR representative, followed by a second-round interview with someone who claimed to be the CEO of the company.
In the first interview the HR representative conducted a live video interview with Software Engineer B, shared his social media account, including personal photographs and videos, all in a successful bid to build trust, said Binance.
“This was more advanced and deceptive than previously seen social engineering approaches,” the company said.
Binance said that during the end of the second interview, Software Engineer B was instructed to download an “assignment.”
Unbeknown to the engineer, the download contained a malicious code repository that was downloaded onto the engineer’s computer, and that executed a series of unauthorized activities.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said.
The malware then went into operation on Oct. 29, and took just four minutes to steal $6.3 billion in cryptocurrency.
“Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address,” Binance said. “Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.”
“This should not have happened, and we apologise for the concern, disruption, and uncertainty it caused our users, partners, and the wider industry,” Binance said in the report published on Tuesday.
Binance said its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026.
“These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry,” it added.
“The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware,” Binance said.
Kim Yo Jong earlier criticized the United States for, as she saw it, erroneously making North Korea a cyber scapegoat.
“The FBI is trying to brand the DPRK [Democratic People’s Republic of Korea] as a ‘cyber criminal state,’ claiming that it obtained information that a hacking organization ’supported’ by the DPRK was involved in the incident,” she said.
“It is a grave political provocation against the DPRK that the U.S. misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong said.
Binance says it has more than 335 million users globally, and trades $95 billion of digital assets and derivatives daily.
Reuters contributed to this report.
We had a problem loading this article. Please enable javascript or use a different browser. If the issue persists, please visit our help center.