Binance has released a detailed account of the breach that saw attackers remove $US6.3 billion (roughly $9 billion) from its platform, saying the operation combined fake recruitment interviews, malware and AI techniques and was linked to actors it attributes to North Korea.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance.
According to the report, the campaign began when an engineer was approached on a job hunting platform by someone posing as a project director. The employee was then interviewed via a social chat app by a person claiming to be the chief executive of a fictitious company and asked to download a test assignment that contained a “malicious code repository.” That download started a chain of unauthorised activity.
Nine days before the large withdrawals, the attackers used access to the lured engineer’s laptop to move laterally into the devices of two more software engineers who maintained Binance’s digital wallets, the exchange said.
Binance’s report says the intruders exploited an “internal AI tool” to gain control of employees’ machines, though the company did not specify the exact nature of that tool or how it was abused.
The company also described an earlier mistake in June, when an engineer downloaded malicious software while installing what Binance described as a popular AI coding tool. That incident allegedly exposed the employee’s role and the identities of colleagues who worked on wallet systems.
Security firms and law enforcement have noted the job-interview trick is a known tactic attributed to North Korean cyber groups. Palo Alto Networks has called the technique a “Contagious Interview,” and investigators point to prior cases that used similar lures, including a 2022 attack on the game Axie Infinity that netted about $US590 million and a later breach of Bybit that took $US1.5 billion.
In the hours after the exploit emerged on October 29, stablecoin issuers including Tether and Circle froze or blocked movement of nearly $US3 billion in assets linked to the theft. Binance temporarily halted withdrawals for almost two days, then progressively reopened them as it worked to contain the incident; the exchange said initial outflows of billions stabilised and by Tuesday hourly deposits exceeded hourly withdrawals.
Binance also said it will cover the financial impact and has nearly restored the stolen cryptocurrency by tapping its corporate treasury and two insurance funds. The company is cooperating with US authorities, including the Federal Bureau of Investigation, the US Secret Service and the Department of Justice, and the FBI has publicly attributed the breach to North Korean-linked hackers.
The exchange reported it had identified and stopped 57 attempted attacks from hackers connected to North Korea during 2026 and has implemented mitigation steps since the exploit. Those measures include rebuilding affected crypto infrastructure, redeveloping the internal AI tool, and improving security scans along with an AI-powered detection system.
The market reaction was muted after the initial shock: Bitcoin fell more than 4 per cent to nearly $US76,000, before recovering somewhat to trade around $US77,600 as tracking firms, exchanges and token issuers worked to trace and restrict the stolen funds.
