Binance Hack Explained: $6.3 Billion Lost After Months of Fake Job Interviews

The Binance hack, the largest crypto theft on record, was not a single clever exploit but a slow-burn campaign that began months before any money moved, according to a postmortem the exchange published on November 3. Binance says attackers combined poisoned software downloads, a bogus recruitment process and access to an internal AI tool to reach the systems that sign wallet transactions.

How the Binance hack unfolded

Binance’s account starts in June, when an engineer on the wallet team looking for an AI coding tool downloaded a tampered installer. Reports differ slightly on the details. One describes a malicious Google ad, another a compromised Homebrew installation. Binance says its security staff caught the malware and replaced the device, but the attackers had already learned who worked on wallet infrastructure and how.

In September, a different engineer was approached through a recruitment platform by someone posing as a project director. The engineer went through a video interview with a supposed HR representative, then another with the “CEO” of a fictitious company. At the end, the engineer was told to download an assignment onto a work computer. Instead, the code swapped the legitimate pyenv development tool for a malicious version that opened a backdoor. Binance says this malware had not been seen before and slipped past its endpoint protection while scrubbing its own traces.

By October 20, the attackers had used that machine and an internal AI tool to take over the computers of two more wallet engineers. One of them held a container deployment token. On October 29, the attackers used it to deploy a container that ran a malicious script reaching the wallet-signing service.

Minutes to move billions

The report says that between 20:05 and 20:09 UTC that day, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Other wallets sent roughly 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers also used the signing service to set up malicious permissions through Ethereum’s EIP-7702 mechanism, which lets a wallet delegate execution to smart contract code.

That step explains why stopping the theft was so hard. Transfers continued for nearly two hours, even after Binance suspended its normal withdrawals. Because the hot wallet used multi-party computation, Binance says, no single private key existed that could immediately revoke those authorizations.

Who is blamed, and who is paying

The FBI has attributed the theft to a North Korean unit it calls “TraderTraitor.” North Korea has pushed back: Kim Yo Jong, sister of leader Kim Jong Un, called the attribution politically motivated. Attribution is the FBI’s finding, and North Korea has denied involvement.

On the financial fallout, Binance says $2.85 billion in stolen assets has been frozen or intercepted. Its leadership says no user bears the loss. By October 31, it had replenished 98% of the affected tokens and was buying the remaining, less liquid assets. Withdrawals have broadly resumed. Co-founder Yi He said the exchange blocked 57 suspected North Korea-linked threats this year, including fake interviews and malicious packages, but added that “the cost of failing to stop even one was severe.”

The questions that remain

Much of what is known comes from Binance’s own postmortem, which has not been independently verified. Even so, the account raises uncomfortable questions. The Verge notes that it remains unclear why this attack succeeded when the danger of interview tasks that require running code on employer-connected machines has been widely warned about for years. Binance also detected the June intrusion yet still could not stop what followed. And it has not publicly explained how an internal AI tool let an intruder take control of other engineers’ machines.

For the wider industry, the Binance hack is a reminder that the weakest point in a crypto exchange may not be its blockchain code but the laptops of the people who run it. A convincing recruiter and a plausible coding test were enough to start a chain of events that ended with billions leaving the exchange’s wallets in a matter of minutes.

Explore more on this topic with Vexel Search.