Key facts
- Binance said the campaign began in June 2026 with a tampered Homebrew install and ran about five months.
- Attackers posing as recruiters sent a malicious coding assignment to a Binance engineer in September, Binance said.
- Binance said attackers obtained deployment credentials on October 20 and installed malicious software on October 29.
- Binance said it froze or intercepted $2.85 billion and replenished 98% of affected token assets as of October 31.
- The FBI attributed the attack to North Korean hackers; Kim Yo Jong denied involvement, calling the attribution politically motivated.
Binance said a fake job interview was one step in a months-long cyberattack that ended with $6.3 billion stolen from the exchange, according to a postmortem it released on Tuesday. The exchange said the campaign began in June 2026, when an engineer downloaded a tampered software package while setting up an AI coding tool.
Binance said it detected the malware and replaced the affected device, but the attackers had already gathered information about its wallet team. In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment, compromising the work computer.
On October 20, the attackers used the compromised computer and an internal AI tool to reach two more engineers' systems and obtain deployment credentials, Binance said. They installed malicious software in the wallet infrastructure on October 29 and gained access to the internal wallet-signing service, which authorizes cryptocurrency transactions, moving funds outside the normal withdrawal process.
Binance said the attackers also exploited Ethereum's EIP-7702 mechanism, which lets wallets delegate transaction permissions to smart contracts, allowing unauthorized transfers to continue after the exchange suspended withdrawals. Its multiparty computation wallet system, which distributes control over transaction signing, complicated efforts to revoke those permissions.
The breach affected approximately $6.3 billion in digital assets, with Binance reporting that $2.85 billion had been frozen or intercepted. The exchange said it would absorb the losses rather than pass them to customers and had replenished 98% of the affected token assets as of October 31.
"This wasn't one mistake or one breach — it was a months-long campaign," Binance co-CEO Richard Teng said in a Tuesday post on X.
The FBI has attributed the attack, which the body describes as the largest cryptocurrency hack in history, to North Korean hackers. On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country's involvement, saying the FBI's attribution was politically motivated and intended to damage North Korea's international standing.