Binance says fake job interviews and malware led to $6.34bn crypto theft
Binance said hackers used fake job interviews, malicious software and a compromised internal AI tool to steal crypto on October 29. The exchange says it has replenished 98% of the $6.34 billion in affected assets.
For information only, not investment advice. Prices change quickly: check the time and source of every figure.
- Binance says attackers used fake job interviews and malware to reach its wallet systems.
- The attack took place on October 29, after months of preparation, the company said.
- Binance says it has replenished 98% of the $6.34 billion in affected assets and will cover customer losses.
Binance said in a security report issued on Tuesday that hackers used fake job interviews, malicious software and a compromised internal AI tool to break into its wallet infrastructure. The attack took place on October 29 and resulted in more than $6 billion in assets being stolen.
Co-CEO Richard Teng said the attackers spent months preparing. He rejected suggestions that the breach came through a single point of failure, such as one employee's laptop.
According to Binance, activity linked to the hack goes back to June. A Binance Wallet DevOps engineer searched for an AI coding tool and downloaded a tampered Homebrew installation. Binance said it detected the activity, replaced the engineer's device and rotated credentials, but the engineer's role and related colleagues on the wallet team had been exposed.
In early September, according to Binance, attackers posing as recruiters contacted another engineer on a job-hunting platform and interviewed them. The engineer was told to download an assignment that contained hidden malicious code. Binance says the attackers later used that access to take control of the wallets of two engineers in late October.
On October 29 the attackers logged in to a software engineer's computer using stolen login details. Binance says they then used unauthorized access to an internal wallet signing service to start transactions outside the normal withdrawal process. Wired reported that funds moved from Binance hot wallets across more than 10 blockchains.
The FBI linked the North Korean group TraderTraitor to the hack on October 31, and tracing firms also pointed to North Korean hackers. Binance does not directly blame the group but points to the FBI's attribution. Teng did not attribute the attack to North Korea himself.
Binance said it has replenished 98% of the $6.34 billion in affected assets and is still buying the remaining, less liquid ones. It has temporarily restricted some withdrawals, pledged to cover all customer losses and used its own reserves. Binance and partners including Tether, Circle and Ripple reportedly froze about $3 billion. Coinbase blocked transfers to compromised wallets.
Binance said it has rebuilt the affected wallet system and internal AI tool, replaced compromised devices and decommissioned affected credentials. It is also getting an independent expert to review its actions and is working with law enforcement to trace and freeze stolen funds. Binance said: "This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
Why it matters
The same scam methods, such as fake job offers and tampered downloads, can target Pakistani users of digital payments and crypto platforms, according to the desk's assessment of the story.
