Attackers stole $6.3 billion in cryptocurrency from Binance on October 29, taking less than four hours to carry out the theft. Binance co-CEO Richard Teng told CNBC that the operation followed months of preparation involving fake job interviews, malware and manipulated AI tools. His account expands on an earlier explanation that focused on a compromised laptop belonging to a DevOps engineer, who helps operate and maintain the platform’s systems.
According to Binance’s incident account on X, the attackers may have begun their preparations in June. A developer tried to install an AI tool found through an internet search. Binance identified a security issue, replaced the device and changed the developer’s credentials, but the attackers had already learned that he worked on the wallet team, which manages the exchange’s digital wallets.
In September, the attackers approached a colleague through a well-known job platform and posed as project managers offering an attractive position. During the purported interview, they persuaded the second developer to install software containing malicious code. On October 20, they also used an internal Binance AI tool to take over additional devices. The theft followed nine days later.
About $2.85 billion of the stolen cryptocurrency was frozen, Binance said. More than $3 billion remained unrecovered, making the incident the largest cryptocurrency theft described in the report. The previous record cited was the $1.4 billion stolen from Bybit in February 2025.
Teng did not explicitly blame North Korea, but acknowledged the FBI’s assessment. The report says investigators suspect the North Korean group TraderTraitor was behind both thefts. North Korea has denied involvement.
Sources: t3n.