The Binance crypto hack, a record $6.3 billion (£4.7 billion) theft, began with a tampered package manager and a fake job interview that put malware on an engineer’s laptop, the exchange said Tuesday. Attackers later used a compromised computer and an internal AI tool in October to control two other engineers’ laptops and carry out the next steps, BBC News reported. For developers, the entry point was everyday tooling and a recruiting lure.
Key Takeaways
- Hackers stole a record $6.3 billion from Binance in a months-long campaign.
- A fake job interview delivered malware to an engineer’s work laptop.
- Attackers used a compromised internal AI tool to reach wallet systems.
- Binance and the industry froze and recovered $2.8 billion; 98% of impacted token assets were replenished.
How the Binance Crypto Hack Began
Binance, operator of the world’s largest cryptocurrency exchange, said hackers entered through a “sophisticated, multi-stage campaign.” PCMag reported that attackers likely learned about engineers in June, when Engineer A accidentally downloaded a tampered Homebrew package manager served through a malicious ad.
Binance detected the install and shut that threat down. PCMag said Engineer A’s role “and his related colleagues on our wallet infrastructure team” had been exposed, giving hackers a way to breach the exchange.
Co-CEO Richard Teng added, “This wasn’t one mistake or one breach—it was a months-long campaign.” Co-CEO Yi He tweeted: “We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.”
Fake Job Interview Malware on a Work Laptop
In September, PCMag reported, those hackers appeared to use that exposure against Software Engineer B. He was contacted on a legitimate job-hunting platform by someone impersonating a project director. The investigation noted: “The purported Project Director arranged a first-round interview with an HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.”
PCMag said it is unclear whether AI deepfakes were used. The interviewer shared a social media account, “including personal photos and videos posted on the platform, in order to build trust.” Binance called the method “more advanced and deceptive than previously seen social engineering approaches.”
He was then told to download an “assignment” onto a Binance work laptop. BBC News said the file arrived in a second interview and used “obfuscation techniques.” PCMag said the assignment was possibly a coding test, while the malware could replace a legitimate development tool “to execute commands and establish communication with an attacker-controlled external server.”
Compromised Internal AI Tool and Wallet Access
In October, BBC News reported, attackers used the compromised computer and a compromised internal AI tool to gain control over two other engineers’ laptops and execute the next steps of the attack. PCMag reported a related step: suspected North Korean hackers used that tool to steal Engineer A’s credentials and hijack an internal wallet-signing service.
Binance called the breach a “serious and highly sophisticated security incident” and said “this should not have happened.” It suspended withdrawals globally until Sunday. Customers then withdrew billions of dollars worth of assets. The company apologised for “the concern, disruption and uncertainty it caused our users, partners and the wider industry.”
It set aside more than 100% of the funds needed to cover the loss and said 98% of impacted token assets were “replenished” as of Saturday. With the rest of the industry, it froze and recovered $2.8 billion. PCMag called the theft the largest on record. A 2025 Bybit hack of $1.5 billion, blamed on TraderTraitor, also known as Lazarus Group, was a then-record, BBC News reported.
| Figure | Reported detail |
|---|---|
| Stolen from Binance | $6.3 billion (£4.7 billion) |
| Frozen and recovered | $2.8 billion |
| Token assets replenished | 98% of those impacted, as of Saturday |
| Funds set aside | More than 100% of the loss |
| Bybit hack, 2025 | $1.5 billion |
North Korea Claims and Binance’s Security Response
The FBI and Secret Service helped trace crypto taken from Binance’s own wallets. On Tuesday Binance wrote on X: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.” Agencies and cyber analysts had already said the hack bore signs of North Korea.
Pyongyang denied it on Tuesday. Kim Yo Jong, a top official and the sister of leader Kim Jong Un, called the accusations another “sinister attempt” by the US to damage North Korea’s public image.
PCMag noted concern that remaining cryptocurrency could be laundered and used to fund North Korea’s weapons programs. Binance said its next steps include:
- Work with law enforcement to trace and freeze affected assets.
- Increase investment in AI tools that can detect security threats.
- Engage third-party cyber experts for a full-scale review.
- Seek a security research fund and work with leading AI and security firms.
For engineering managers, this is analysis, not a further finding from Binance. The reports describe a package-manager ad, a hiring file, and an internal AI tool on the way to a wallet-signing service. That trust gap also shows up in backdoored AI coding tools and supply-chain attacks that start with one unrevoked key. Binance said it already knew North Korea’s hacking tactics. In this reading, the one miss that got through still reached signing systems.
