Binance says a fake job interview and a malicious software download helped attackers gain access to its systems before $6.34 billion was taken from the exchange’s wallets. In a security update issued Tuesday, the company said the theft unfolded on October 29 and that the attackers moved the funds in about 20 minutes.

According to Binance’s initial investigation, the attackers used access to engineers’ computers to move through the company’s network and exploit an internal AI tool. They ultimately accessed a wallet-signing service, which allowed them to initiate transactions outside Binance’s normal withdrawal process.

The company traced suspicious activity to June, when an engineer it identified as Engineer A downloaded a tampered Homebrew installation found online. Binance said it detected and addressed that incident, but information about the employee was later exposed to the attackers.

In early September, another engineer, Engineer B, was approached through a job-hunting platform and invited to a video interview by someone posing as a recruiter. During a later interview conducted by online chat, the engineer was asked to download an assignment containing a malicious code repository onto a work computer, Binance said. The malware was designed to disguise itself as a legitimate development tool and communicate with an attacker-controlled server.

Binance says that toward the end of October the attackers used access to Engineer B’s computer to gain control of wallets associated with Engineer A and another software engineer. On the day of the theft, they also used stolen login details to access a staff member’s computer before targeting the wallet-signing service.

The exchange said it had set aside funds to cover the losses and rebuilt or replaced internal systems affected by the attack. It apologized for the disruption and uncertainty, while stressing that the incident involved more than a single breach or a straightforward phishing attempt.

Almost half of the stolen cryptocurrency was frozen by parts of the industry where that was possible, Binance said. The remaining funds are being moved through a complex laundering process. Elliptic’s Tom Robinson said the activity used around 12,000 wallets across 11 blockchains in its first three and a half days, with more than 40,000 transactions.

Binance did not directly identify the attackers, but noted that the FBI attributed the hack to North Korea on October 31. Several tracing firms also linked it to North Korean hackers, including the TraderTraitor group. Security firm Sophos’s Rafe Pilling said the reported approach was consistent with the group’s tactics, which involve compromising engineers and learning how a victim’s systems handle transactions.

Binance said its security team detected and prevented 57 suspected North Korea-linked cyber cases during 2026. Its investigation into the theft is ongoing.

Sources: WIRED.