Binance details how North Korean-linked hackers exploited fake job interviews in $6.34 billion breach

Binance disclosed that a cyber-attack on Oct. 29 resulted in the theft of roughly $6.34 billion from its platform, marking what it described as the largest crypto heist to date. The exchange said it has restored 98% of the compromised assets using its own reserves, while the remaining funds involve low-liquidity tokens that are difficult to replace.

The U.S. Federal Bureau of Investigation linked the operation to hackers with ties to North Korea, a claim denied by officials in Pyongyang. About $2.85 billion of the stolen amount has been frozen, preventing the perpetrators from moving or converting it.

According to Binance’s investigation, the attackers began reconnaissance as early as June, first targeting a platform engineer with a malicious version of the Homebrew software package. Although the malware was later identified and removed, the hackers harvested credentials and internal information.

In September, the group approached another engineer through a legitimate job-search site, offering an interview for a fictitious company. After establishing trust via shared social-media content, they sent a test exercise that contained malware employing sophisticated obfuscation and evasion techniques, including a compromised development-tool component.

The malicious code enabled the intruders to connect to Binance’s internal systems. On Oct. 20, the attackers leveraged the compromised access and an internal AI tool to seize control of software used by two additional engineers. Nine days later, they activated the malicious code, triggering the large-scale theft.

"We have replenished 98 per cent of the affected assets from our own funds," a Binance spokesperson said.

The incident caused a sharp decline in the prices of major cryptocurrencies across markets.