North Korean hackers are accused of stealing $6.3 billion from Binance after months of fake interviews, malware, and employee deception.
The world’s largest cryptocurrency exchange, Binance, lost about $6.3 billion to what the FBI believes was a North Korean state-sponsored ransomware gang. Contrary to what you might think, however, hackers didn’t infiltrate the organization with some futuristic tools.
Instead, according to details shared by Binance, one of its software engineers fell for a ruse involving a fake job interview, downloading what they thought was a coding assignment for the pretend role, only for it to contain malware.
The attack started months before the money disappeared
From there, Binance says hackers accessed its internal AI tool to compromise employee computers and eventually infiltrated its wallets, stealing billions of dollars’ worth of crypto. The attack unfolded over several months, starting in June 2026 when a Binance employee downloaded what was believed to be legitimate software while searching for a development tool, only for a malicious version to appear first in the results because of an ad.
Binance’s security team noticed something was amiss and took steps to contain the issue, including changing credentials and issuing the employee a new computer, but the hackers still learned details about the employee’s role and the names of colleagues who worked on Binance’s wallet infrastructure.
An internal AI tool was leveraged
On October 20, the attackers used an already compromised employee device and an internal AI tool to hack into the computers of two software engineers with roles related to Binance’s wallets. While it’s unclear exactly how the attackers used the AI tool, Binance says it wasn’t simply an LLM used to generate phishing emails or malicious code.
On October 29, using credentials stolen during the attack and a piece of malicious code, the attackers accessed Binance’s wallet infrastructure and began transferring billions of dollars’ worth of crypto assets. Perhaps most deviously, Binance says the attackers initially got into one of its engineers’ computers after contacting them through a legitimate recruiting service, pretending to be a director at a company hiring for a role.
Fake social media accounts, photos, and videos
Not only did the engineer speak with what they thought was a recruiter over a video call, but they were later introduced to someone claiming to be the organization’s CEO. During the first interview, the supposed HR representative also shared a social media account featuring personal photos and videos, making the operation appear more convincing.
Eventually, the engineer received what they thought was a coding assignment as part of the interview process, only for it to contain malware when they downloaded the repository to their Binance-issued laptop.
The $6.34 billion breakdown
In total, Binance says the attackers stole crypto assets worth $6.34 billion, most of it from the exchange’s so-called hot wallets that are connected to the internet and used to facilitate withdrawals and other transactions. The bulk of the attack appears to have taken place over just 20 minutes, although Binance says it took around four hours to stop all unauthorized transfers as it attempted to contain the attack and revoke access.
According to blockchain analytics firm TRM Labs, five different Binance wallets sent a combined total of 233.46 million XRP coins in just four minutes, whilst a hot wallet for bitcoin transferred 18,270 BTC (worth around $1.47 billion at the time). In total, TRM Labs puts the value of stolen Ethereum at around $3.79 billion. Notably, TRM Labs says the hackers made extensive use of an advanced Ethereum feature called EIP-7702, which lets smart contracts temporarily control transactions for a standard wallet.
Turning wallets into cash machines
Using what are known as signed authorizations, the hackers effectively granted smart contracts control over the wallets, allowing them to move funds to addresses they controlled outside of Binance’s usual withdrawal system. As of November 3, Binance says it has frozen around $2.85 billion worth of stolen crypto assets with the help of its partners.
TRM Labs has tracked the remainder being laundered in an attempt to obscure the attack’s origins, with the hackers using multiple blockchains and DeFi liquidity pools to muddy the waters. Binance says it won’t be making customers pay for the hack, and as of November 3, it had topped up around 98% of affected assets with money from its own coffers.
The aftermath
The exchange says it’s increasing its investment in AI-driven threat detection and will set up a fund to support security research going forward. Customers reportedly pulled around $3.64 billion from Binance following news of the hack, according to Reuters, although withdrawals have since stabilized. The hack dwarfs previous attacks on crypto exchanges, including the $1.5 billion Bybit hack in February 2025, and is set to further rattle confidence in crypto’s security.
Perhaps the most alarming aspect of the Binance hack is how the attack was staged. Binance says the attackers spent months studying its operations and employees before targeting an engineer through a recruitment website, conducting a fake interview and issuing a coding test.
This is a stark reminder that as AI tools get more powerful and digital assets grow in importance, so too will the sophistication attackers use to steal them. Securing private keys alone won’t be enough to keep crypto exchanges safe going forward.
In case you missed:
- Japan Declares Cybersecurity Emergency: AI Cyberattacks Hit 14 Million People and 495 Businesses
- Black October: Governments Pull Websites Offline as Cybersecurity Chaos Spreads
- The Hugging Face Incident: How OpenAI’s Agents Learnt to “Sacrifice” Themselves for the Greater Good
- Black October Gets Worse: AI Attacks Hit India, Forcing CERT-In to Issue Security Alert
- Apple, Tesla, Tata: The Cyberattack That Hit India’s Manufacturing Boom
- GPT-6 Astra Is Here. OpenAI Says the AGI Era Has Begun
- The End of Hacking? India Successfully Tests ‘100% Uncrackable’ Quantum Laser Tech
- While Bezos Bets $100 Billion on Physical AI, His Top AI Picks Walk Away to Model the Universe
- China Wants a Future Without Windows. It Starts This September.
- Drones Just Made 19 Million Gallons of Rain in Alaska in Under 3 Hours
