A coding assignment from a prospective employer seemed like an ordinary part of a job interview. Instead, it was one step in a months-long cyberattack that ended with $6.3 billion stolen from Binance, raising questions about how exchanges protect themselves against threats that target their employees.
The attack was part of a coordinated campaign that exploited both human vulnerabilities and internal security systems, according to a postmortem released by Binance on Tuesday. The exchange’s findings detailed how hackers gradually gained access to its wallet infrastructure before the Oct. 29 theft.
How hackers infiltrated Binance
According to Binance’s security report, the attack campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool. Although Binance detected the malware and replaced the affected device, the attackers had already gathered information about the exchange’s wallet team.
In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment. The malware compromised the engineer’s work computer and evaded the exchange’s security protections.
On Oct. 20, the attackers used the compromised computer and an internal AI tool to gain access to two additional engineers’s systems, obtaining deployment credentials that allowed them to install malicious software within Binance’s wallet infrastructure on Oct. 29.
The attackers then gained access to the exchange’s internal wallet-signing service, which authorizes cryptocurrency transactions. This allowed them to move funds outside the normal withdrawal process.
“This wasn’t one mistake or one breach — it was a months-long campaign,” Binance co-CEO Richard Teng said in a Tuesday post on X.
Source: Richard Teng
Binance said the attackers also exploited Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts, enabling unauthorized transfers to continue even after the exchange suspended withdrawals. Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, complicated efforts to revoke those permissions.
The breach affected approximately $6.3 billion in digital assets, with Binance reporting that $2.85 billion had been frozen or intercepted, according to its latest accounting. The exchange said it would absorb the losses rather than pass them on to customers and had replenished 98% of the affected token assets as of Oct. 31.
The attack, the largest cryptocurrency hack in history, has been attributed to North Korean hackers by the Federal Bureau of Investigation (FBI). On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement, saying the FBI’s attribution was politically motivated and intended to damage North Korea’s international standing.
Binance reports 57 cyber threats blocked this year
Binance co-founder Yi He said Tuesday that the exchange’s security team had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages and social engineering attempts aimed at stealing credentials or installing malware.
“We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened,” she said.
Magazine: Binance hackers raced to move billions before it could be frozen
