Binance has disclosed further details of a $6.3 billion cyberattack that involved fake job interviews, malicious software and an internal artificial intelligence tool. The exchange said the campaign began in June and ended with the theft of digital assets in October.
London's trading industry is coming home!
According to an incident report published today (Tuesday), attackers initially compromised an engineer's computer through a tampered version of Homebrew, a software package manager. The employee had downloaded it after clicking an online advertisement while searching for an AI coding tool.
Hackers Exploited Employee Devices and Internal AI
Binance detected the suspicious activity, replaced the employee's device and changed the affected credentials. However, the attackers had already gathered information about the engineer and other members of the wallet development team.
- Moscow Exchange to Launch Digital Currency Trading With BTC, ETH and USDT
- US Secret Service Joins Circle, Tether in Freezing $2.37B in Binance Hack Funds
- India Names Binance and Bybit Among Foreign Platforms in $585M Crypto Remittance Probe
In September, the hackers approached another engineer through a job-hunting platform. They posed as representatives of a fictitious company and arranged interviews with individuals claiming to be its executives. During the process, the engineer received a coding assignment containing malicious software.
The compromised devices provided further access to Binance's internal systems. On October 20, the attackers used an internal AI tool and information from the compromised computers to access the systems of two wallet developers.
Binance Hot Wallets Drained Across Multiple Blockchains
The attack escalated on October 29, when the hackers used stolen credentials to deploy a container and run a malicious script. They exploited Ethereum 's mechanism to obtain execution permissions over a Binance hot wallet, allowing them to initiate unauthorised transactions.
The attackers first moved approximately 233 million XRP from five internet-connected wallets. They then targeted wallets across multiple blockchains, stealing approximately $6.3 billion in digital assets.
FBI Attributes Attack to North Korea
The FBI attributed the attack to TraderTraitor, a hacking group linked to North Korea. The group has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025.
North Korea denied involvement. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, described the FBI's attribution as a political provocation.
Binance said it detected and blocked 57 suspected North Korea-linked cyberattacks in 2026. Many involved fraudulent recruitment approaches and malicious software.
