Key facts
- Binance said the attackers compromised an engineer's work computer through a fake job interview before the October 29 theft.
- Binance said the attackers used an internal AI tool to gain control of other engineers' computers.
- Binance said it detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026.
- Binance chief security officer Jimmy Su told Decrypt the exchange discards suspected North Korean resumes every day.
- Binance said on-chain authorizations kept working after it suspended withdrawals, and multi-party custody left no single key to revoke them.
Binance said hackers it linked to North Korea drained $6.3 billion from the exchange on October 29, the largest crypto hack on record, in an operation that took about 20 minutes. The exchange said the attackers compromised a Binance engineer's work computer through a fake job interview, used an internal AI tool to gain control of other engineers' computers, and then used stolen credentials to hijack an internal wallet signing service.
Binance chief security officer Jimmy Su told Decrypt in August 2025 that the exchange throws out suspected North Korean resumes every day, and that almost all large North Korea-linked hacks at the time had involved a fake employee helping facilitate the attack. Su said the only reliable detection sign is a slow internet connection, which he attributed to translation and voice-changing tools running during calls.
Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using techniques ranging from fraudulent job interviews to fake video conferencing apps. One North Korea-linked group, known as WaterPlum or Contagious Interview, infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026, took funds or credentials from more than 7,500 crypto wallets and moved about $137.5 million to North Korea, according to the report.
According to Binance, the October attack began when an engineer was approached through a legitimate job-search platform by someone posing as a project director who set up two interviews. In the second, held on a chat app, the engineer was told to download an assignment onto his work computer; the code repository contained previously unknown malware that ran during setup and connected to an attacker-controlled server.
Binance said the attacker used stolen credentials on October 29 to deploy a container and gain unauthorized access to an internal wallet signing service, which let it initiate transactions outside the normal withdrawal process. On Ethereum, the exchange said, the attacker used the signing service to exploit EIP-2510, a mechanism that lets an account delegate execution rights to a smart contract, giving an attacker-controlled contract partial control over a Binance hot wallet. The exchange said those on-chain authorizations kept working after it suspended withdrawals, and that multi-party computation on the hot wallet left no single private key it could use to revoke them quickly.
Before the Binance theft, the largest crypto hack was Bybit's loss of $1.4 billion in February 2025. Cybersecurity firms said North Korean hackers planted malicious code in the infrastructure of wallet provider Safe, and Bybit told Decrypt its own infrastructure was not compromised.
Su also told Decrypt that North Korean hackers poison public code libraries, ranking it second behind fake employees among attack methods. In September 2025, software security firm ReversingLabs found two NPM packages that used Ethereum smart contracts to download malware, tied to a network of GitHub repositories mostly branded as crypto trading bots.