Binance, the world's largest cryptocurrency exchange, has disclosed that the recent $6.3 billion theft was the result of a sophisticated multi-stage operation involving a malicious software download and a bogus job interview. The company revealed the details in a post on X, shedding light on how hackers, linked by the FBI and independent analysts to North Korea, managed to breach its systems.
The attack unfolded over several months, starting in June when an engineer inadvertently downloaded tampered code while installing a popular AI coding tool. Although Binance's security team detected the anomaly, replaced the device, and updated credentials, the engineer and his colleagues on the wallet infrastructure team had already been exposed.
In September, another engineer was approached by an individual posing as a project director on a legitimate job-hunting platform. The attacker arranged an initial interview with an HR representative and a second interview with someone impersonating the CEO. During that second interview, the engineer was instructed to download an assignment containing malicious code onto his work computer, which initiated a series of unauthorized activities.
Binance described the attack as "more advanced and deceptive than previously seen social engineering approaches." The compromised computer was used to access an internal AI tool and gain control over two other computers, including that of the first engineer. On the day of the hack, the attackers logged into a third engineer's computer using credentials obtained from the first engineer, launching the theft.
Blockchain intelligence firms quickly connected the attack to TraderTraitor, a North Korean hacking unit known for targeting the crypto industry. The FBI confirmed the attribution on Saturday, stating that North Korea was responsible. However, Pyongyang denied involvement, with Kim Yo Jong, the influential sister of leader Kim Jong Un, calling the accusations "a trite provocation." She added that the U.S. has a history of "blindly linking the DPRK with 'cyber crime' incidents whenever they occur on an international scale."
The hack prompted a coordinated response from crypto companies, which froze approximately $3 billion in assets to mitigate the damage. Binance has vowed to cover all losses, stating that it has replenished 98 percent of impacted assets. The company also announced immediate measures to contain the incident, including closing the entry points used in the attack, rebuilding or replacing compromised systems, and implementing tighter device controls and enhanced risk detection.
This incident underscores the growing threat posed by state-sponsored hacking groups to the cryptocurrency industry. It also raises questions about the security protocols of major exchanges and the effectiveness of international efforts to combat cybercrime. The U.S. government has been investigating the hack, with President Trump stating that the probe is ongoing and that the North Korea link is not yet fully confirmed.
As the crypto market continues to grapple with the fallout, the Binance hack serves as a stark reminder of the vulnerabilities inherent in digital assets. The company's response, including its commitment to customer compensation, will be closely watched by regulators and industry stakeholders alike.
