Binance says hackers plotted $6.3 billion heist for months

SAN FRANCISCO — Binance, the world’s largest cryptocurrency exchange, said Tuesday that the hackers behind last week’s $6.3 billion theft had spent months preparing for the heist, luring an employee with a fake job interview and planting tampered software before using the company’s artificial intelligence tool to reach its wallet systems.

Someone posing as a project director contacted a Binance software engineer in September through a job-hunting platform, according to the company’s initial report on the attack. After two rounds of interviews, including a live video call with someone purporting to be a human resources representative, the engineer was told to download an “assignment” onto his work computer. The file contained malicious code that the company’s security tools failed to detect.

On Oct. 20, the week before the theft, the hackers used that computer and an internal Binance AI tool to take control of the work computers of two engineers on Binance’s wallet team, one of whom had permissions to deploy software. Nine days later, they used that permission to gain access to a service that signs transactions and began draining the exchange’s hot wallets, which hold assets for quick withdrawals, over nearly four hours.

“This should not have happened,” the company said in the report.

Related

More

The report is the most detailed account to date of by far the largest theft in the history of the crypto industry, which has long been a target for hackers drawn to large pools of digital assets that can be moved across borders in minutes. The previous record was set in February 2025, when hackers stole about $1.5 billion in digital tokens from Bybit, a Dubai, United Arab Emirates-based exchange.

The hack is also the latest blow to Binance, which has a history of legal trouble. In 2023, Binance pleaded guilty to breaking U.S. anti-money-laundering laws and paid $4.3 billion in penalties. Binance’s founder, crypto billionaire Changpeng Zhao, served four months in federal prison and later got a pardon from President Donald Trump.

On Saturday, the FBI said that the attack on Binance was carried out by TraderTraitor, a North Korean hacking unit. North Korea has denied the accusation. Binance said it had caught and blocked 57 other suspected North Korean hacking attempts this year alone.

The attack also stood out for its patience. The hackers began probing Binance’s wallet team in June, when an engineer downloaded a tampered version of a popular software tool, the company said. The fake job interview that followed was elaborate: one phony interviewer shared a social media account filled with personal photos and videos to seem more convincing, a tactic Binance called more advanced and deceptive than any the company had experienced.

The hackers behind the Binance attack moved the stolen cryptocurrency through about 12,000 wallets in order to cover their tracks and get around efforts to freeze the funds, according to a report by Elliptic, a crypto analytics firm.

Binance said Tuesday that halting withdrawals was not enough to stop the attack because the hackers had exploited a feature that let them keep moving funds independently of the company’s systems. Using Binance’s hijacked system, the hackers were able to partly take control of one of the exchange’s accounts on ethereum, one of the most widely used crypto networks. That access was recorded on the network itself, not inside Binance’s systems, allowing the hackers to keep stealing money.

The account used a security setup that spreads control across multiple systems, so there was no simple way to quickly revoke the hackers’ access, Binance said. Engineers instead had to devise a workaround to stop the theft.

About $2.85 billion has been frozen or intercepted, the company said. Binance said that it would cover customers’ losses and that it had already replenished 98% of the affected tokens.

Binance said it had rebuilt the hacked systems, replaced compromised computers and would bring in outside security firms to review the attack. It also said it was working to set up a security research fund and was teaming up with AI companies to better protect crypto systems.