Binance Reveals How Hackers Pulled Off the $6.3bn Wallet Heist

Binance says hackers drained $6.34bn (£4.7bn) from its hot wallets last week using a chain of malware, fake job interviews and one of its own internal AI tools. The world's largest cryptocurrency exchange disclosed on Tuesday that $2.85bn of that haul has been frozen or intercepted — leaving roughly $3.5bn still unaccounted for.

By Nathan Brooks

How did the attackers get in?

The operation began in June, when a Binance engineer inadvertently downloaded malware. According to Binance's update, that infection exposed the employee's role — and the roles of others on the team responsible for Binance's crypto wallet infrastructure. That's the detail practitioners should sit with: the reconnaissance didn't start at the vault, it started at the org chart.

In September, a second engineer was contacted through a legitimate job-hunting platform by a fake project director. A first-round video interview with a sham HR representative followed. Then came a second-round interview, conducted on a chat app, with the "CEO" of a fictitious company. During that session, the engineer was tricked into downloading malware onto his computer.

What does the timeline of the attack show?

Binance's update lays out a precise sequence:

• June — Malware downloaded inadvertently by a wallet-team engineer, exposing team roles.
• September — Recruitment scam on a legitimate job platform; two rounds of fake interviews; second engineer's machine compromised.
• 20 October — Attacker used the compromised computer plus an internal AI tool to seize control of the engineer's system and that of a second wallet developer.
• 29 October — Attacker used the second developer's computer, with credentials stolen from the first engineer, and triggered a malicious script to launch the raid on the hot wallets.

The internal AI tool is the uncomfortable part. The attackers didn't just break in — they used Binance's own tooling to move laterally between two wallet developers in a single day.

Who does the FBI blame?

The FBI said on Saturday that North Korea was responsible. North Korea, a prolific crypto hacker, rejected the accusation outright on Tuesday.

Kim Yo-jong, the influential sister of leader Kim Jong-un and a ruling party official, dismissed the claims through state news agency KCNA. She said the allegations proved Washington remained hostile toward Pyongyang.

"The FBI is trying to brand the DPRK [the Democratic People's Republic of Korea] as a 'cybercriminal state,' claiming that it obtained information that a hacking organisation 'supported' by the DPRK was involved in the incident," KCNA quoted her as saying.

"But the US assertion is absurd rhetoric and nothing new," she said, adding: "It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds."

What does this change for security teams?

Binance was blunt about the failure. "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company said in its update.

There's an irony worth flagging. Deepfake job interviews are already a documented part of North Korea's cyber arsenal — but usually in reverse. In the typical scheme, bogus IT professionals apply for real jobs to funnel salaries back to Pyongyang. Here the technique was flipped: fake employers hunting real engineers with privileged access.

For anyone running hiring or wallet infrastructure, the practical question is whether your recruitment channels and your internal AI tools are treated as part of the attack surface. At Binance, both were — and $6.34bn left the building. With $2.85bn frozen so far, the recovery effort is now a race between exchange security teams and the attackers' laundering pipelines.