Binance has disclosed that attackers used a fake job interview and a malicious coding assignment to compromise an employee's work computer as part of a months-long campaign that culminated in the theft of approximately $6.3 billion in cryptocurrency from the exchange on October 29.

In its latest security findings released on November 3, the cryptocurrency exchange detailed how the attackers used social engineering, compromised employee devices, internal tools and stolen credentials to reach systems involved in wallet operations.

The disclosure provides a more detailed account of how the attackers gained access to Binance's internal environment before executing unauthorized withdrawals across multiple blockchain networks.

According to the exchange, the campaign involved multiple stages beginning in June, with a subsequent fake recruitment process in September targeting another software engineer.

Fake Recruitment Process Used to Compromise Employee Computer

Binance said the attackers initially approached a software engineer from its wallet development team in June through an advertisement for a modified version of a coding tool.

The employee downloaded the compromised application, allowing attackers to gain access to the device and potentially expose information about the employee's role and connections within the wallet development team.

Although Binance detected the compromise, replaced the affected device and changed the employee's credentials, the attackers had already obtained information about the employee's responsibilities and other members of the team.

In September, the attackers targeted a second software engineer who was exploring a new employment opportunity.

The employee reportedly participated in a series of video interviews with individuals posing as representatives of a fictitious company, including a person presented as its chief executive.

Following the interviews, the engineer was asked to download a coding assignment. The supplied repository contained malicious code that compromised the employee's computer.

The technique is a form of social engineering, in which attackers manipulate individuals into performing actions that expose their devices, credentials or access to internal systems.

Rather than exploiting a vulnerability in Binance's blockchain infrastructure directly, the attackers used a seemingly legitimate recruitment process to gain access through an employee's work environment.

Internal AI Tool and Stolen Credentials Used in Attack

The campaign continued beyond the initial compromise of the two employees' computers.

Binance's findings indicate that by October 20, attackers had used the compromised computer alongside an internal artificial intelligence tool to access the systems of two wallet developers.

On October 29, the attackers used one developer's computer and credentials stolen from the other to execute a malicious script that initiated unauthorized withdrawals.

The bulk of the stolen cryptocurrency was transferred within approximately 20 minutes, beginning around 20:05 UTC.

Binance previously said its investigation found no evidence that wallet private keys had been leaked. The exchange's initial findings instead pointed to compromised employee devices, internal infrastructure and unauthorized access to systems involved in transaction processing.

The distinction is significant because the incident did not initially appear to involve the direct theft of private keys. Instead, attackers reportedly compromised the operational environment and abused access to systems that could authorize or facilitate withdrawals.

Binance Theft Reaches Approximately $6.3 Billion

The October 29 incident resulted in approximately $6.3 billion in cryptocurrency being transferred from Binance-controlled hot wallets across roughly ten blockchain networks, according to the exchange.

Independent estimates from blockchain intelligence firms placed the losses at approximately $6.36 billion to $6.4 billion.

The incident is considered the largest cryptocurrency exchange theft on record, exceeding the approximately $1.5 billion Bybit breach in February 2025.

The scale of the attack also drew attention to the risks associated with employee-targeted cyberattacks, particularly those that exploit trusted access to internal systems rather than attempting to compromise blockchain networks directly.

The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group. Blockchain analytics firms, including TRM Labs and Chainalysis, also linked the activity to North Korean operators based on their investigations and on-chain assessments.

North Korea has rejected the US attribution, according to Reuters.

The FBI also published cryptocurrency addresses associated with the activity to support efforts by exchanges and other industry participants to identify and restrict transactions involving the stolen funds.

Binance Commits More Than $6.34 Billion to Cover Losses

Following the breach, Binance committed to absorbing the full financial impact of the stolen cryptocurrency rather than passing the losses on to customers.

The exchange said it had allocated more than $6.34 billion in company resources, including funds from its Secure Asset Fund for Users (SAFU) and corporate treasury.

A substantial portion of the allocation was already held in the affected token assets, while the remaining shortfall was acquired through market purchases and over-the-counter transactions.

By its November 2 recovery update, Binance said it had replenished approximately 95% of the impacted amount. The remaining 5% consisted of tokens outside its ten largest affected assets, which were less liquid and therefore more difficult to source at the required scale.

The exchange identified Bitcoin (BTC), Ether (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD and Zcash (ZEC) as fully backed at a 1:1 ratio.

The replenishment figure represents replacement assets acquired to cover affected user balances, not the recovery of 95% of the original cryptocurrency stolen by the attackers.

Separately, approximately $2.85 billion to $3 billion in assets associated with the breach had reportedly been frozen or intercepted through coordination with token issuers, blockchain intelligence firms and other industry partners.

These freezes represent a separate recovery effort from Binance's acquisition of replacement assets.

Withdrawals Reopen as Binance Expands Recovery Measures

Binance temporarily suspended withdrawals following the incident while it contained the breach, reviewed affected infrastructure and conducted additional security checks. Deposits and unaffected platform services remained operational.

The exchange began restoring withdrawals in phases on November 1, initially covering selected assets across 15 blockchain networks.

By November 3, Binance had announced another phase of withdrawal restoration, covering additional assets across networks including BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base.

The latest rollout is also progressive, with individual assets becoming available only after completing security and operational readiness checks.

Binance also completed the generation of a zero-knowledge proof for its October 31 Proof of Reserves snapshot on November 2.

The verification allows users holding the ten fully backed assets to independently check that their balances are included in the exchange's reserves and backed at a minimum 1:1 ratio.

The exchange said it would continue restoring withdrawals for additional assets and networks as security checks are completed.

Security Measures and Incident Review

Beyond covering the financial impact, Binance said it is strengthening its security infrastructure following the breach.

The exchange has outlined plans to increase investment in artificial intelligence-enabled threat detection and establish a security research fund, alongside targeted initiatives with leading AI companies.

These measures are intended to improve the detection of suspicious activity and strengthen safeguards across internal systems and wallet-related operations.

Binance also said it would publish a comprehensive post-incident report after completing its investigation, including further details about the attack sequence, the vulnerabilities exploited and the additional safeguards being implemented.

The incident has exposed how a recruitment process, ordinarily used to identify and onboard new employees, can become an entry point for sophisticated cyberattacks when malicious actors exploit trust and legitimate workplace procedures.

For cryptocurrency exchanges, the breach underscores that protecting digital assets requires more than securing wallet private keys and blockchain infrastructure. Employee devices, internal applications, credentials and transaction authorization systems also form part of the security perimeter.

Binance's financial response and withdrawal restoration have addressed significant portions of the immediate disruption, but the full effectiveness of its security improvements will depend on the findings of its investigation and the safeguards implemented to prevent similar attacks.

‍