Binance Details $6.34 Billion Crypto Hack Linked to Months-Long Operation

Binance says the October 29 cyberattack was the result of a months-long operation involving fake job interviews, malicious software downloads, compromised developer tools, and access to an internal AI system.
The operation reportedly began in June, when a Binance wallet engineer downloaded a tampered installer while setting up an AI coding tool. Although Binance detected the threat, replaced the device, and reset credentials, the attackers had already gathered information about the wallet team.
In September, another engineer was targeted by a fake recruiter and completed two interviews for a nonexistent position. The supposed coding assignment secretly installed malware on the engineer’s work computer.
By October 20, attackers had allegedly used the compromised device and Binance’s internal AI tool to reach two additional wallet engineers and obtain credentials that allowed them to deploy software.
On October 29, those credentials were used to execute malicious code inside Binance’s wallet-signing system, triggering unauthorized cryptocurrency transfers. The attackers also exploited an Ethereum authorization feature that allowed some transfers to continue after Binance suspended withdrawals.
Binance says approximately $2.85 billion in funds was frozen or intercepted. Separately, the exchange replenished 98% of the affected token assets using its own reserves. This represents asset replacement, not necessarily recovery of the stolen funds.
The FBI attributed the attack to North Korea’s TraderTraitor hacking group. North Korea denied involvement, with Kim Yo Jong dismissing the U.S. allegations as “absurd rhetoric” and a “grave political provocation.”