Binance says hackers spent months preparing for last week’s theft of $6.3 billion in cryptocurrency. In its account of the attack, the exchange described a fake recruitment process that led to malicious software being installed on an employee’s work computer, followed by the use of an internal AI tool to access wallet systems.
According to Binance, someone posing as a project director contacted a software engineer through a job-hunting platform in September. After two interviews, including a video call with a person claiming to work in human resources, the engineer was asked to download an assignment to his work computer. The file contained code that Binance’s security tools did not detect.
On Oct. 20, attackers used the compromised computer and Binance’s AI tool to take control of the work computers of two engineers on the wallet team. One had permission to deploy software. Nine days later, the hackers used that access to reach a service that signs transactions and began draining the exchange’s hot wallets, which hold assets for quick withdrawals. The theft continued for nearly four hours.
“This should not have happened,” Binance said in its report.
The FBI said on Saturday that the attack was carried out by TraderTraitor, a North Korean hacking unit. North Korea has denied the accusation. Binance said it had identified and blocked 57 other suspected North Korean hacking attempts this year.
The $6.3 billion theft is the largest in the history of the crypto industry, according to the report. The previous record was set in February 2025, when hackers stole about $1.5 billion in digital tokens from Dubai-based exchange Bybit.
Sources: The New York Times Technology.