Binance Reveals Details of Multi-Stage $6.3 Billion Cyberattack
Crypto exchange Binance has disclosed details of a sophisticated, multi-stage cyberattack on October 29, which resulted in over $6.3 billion in assets being stolen. The attackers reportedly used fake job interviews and compromised AI tools to infiltrate the system.
This story was prepared with the help of artificial intelligence, compiled from several sources, and read and approved by our editor.
Binance, the world's largest cryptocurrency exchange, has shared its initial findings regarding a cyberattack that occurred on October 29, leading to the theft of over $6.34 billion in assets. The company stated that the incident was not a single point of failure or a simple phishing attempt, but a complex operation involving months of preparation by the attackers.
According to Binance's report, the attackers initiated their infiltration in June by tricking an engineer into downloading malicious software disguised as a developer tool. In September, they posed as recruiters, conducting a series of fake job interviews with another engineer, which involved a coding exercise containing hidden malware. These methods allowed them to gain unauthorized access to internal AI tools and the exchange's wallet infrastructure.
During the attack, 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC were transferred from Binance's hot wallets to addresses controlled by the attackers. Upon detecting unusual transaction volumes, Binance halted withdrawals and collaborated with industry partners to freeze or seize approximately $2.85 billion in assets. However, the malicious authorizations operated independently of the normal withdrawal infrastructure, complicating efforts to stop all unauthorized movements.
The Federal Bureau of Investigation (FBI) has linked the attack to North Korean hacker groups. Binance co-CEO Richard Teng stated that 98% of the affected assets have been replenished, with the process ongoing for more illiquid assets. The company has since rebuilt the affected wallet system and internal AI tool, expanded security scans, and is working with independent experts to strengthen its defenses.
Binance acknowledged that the incident caused a sharp but short-lived hit to confidence across crypto markets. Despite the breach, the exchange maintains that it remains financially sound and is focused on recovering the remaining funds and preventing future attacks. The company emphasized its ongoing investigation and close cooperation with law enforcement agencies.