Binance says a fake recruiter led to its $6.34B theft
Binance's own account of the breach: a tampered installer, a bogus job offer and an internal AI tool, spread over five months.
The theft that cost Binance about $6.34 billion took five months to set up, not one slip, according to the company's initial incident report: a tampered installer in June, a fake job interview in September and an internal AI tool that let the attacker move between employees. Those are Binance's conclusions. The independent review it promises does not exist yet.
It began in June. A wallet DevOps engineer downloaded a manipulated copy of Homebrew, a software installer, while looking for an AI coding tool. Binance replaced his computer and rotated credentials, yet in October the attacker used a container-deployment token taken from that machine. Binance does not say how it was still valid.
In September, a second engineer was approached through a job platform by someone posing as a project director at a company that did not exist. A video interview with a purported HR representative came first, complete with a social media profile full of personal photos and videos to build trust. The second interview, on a messaging app, was with someone who claimed to be the CEO. It closed with a request: download a coding "assignment" onto the engineer's work computer.
The code installed malware that phoned home to an outside server. The device's security tools did not catch it, Binance says.
On Oct. 20, using that computer and the internal AI tool, the attacker took over two more wallet engineers. Which tool it was, and how it was abused, is not known.
By Oct. 29 the attacker had stolen credentials, spun up a container and run a script. Transfers began around 20:05 UTC. Binance lists what left:
- 233.46 million XRP, from five hot wallets (those kept online to handle transactions).
- 18,270 BTC, with no precise time given.
- About 970,500 SOL, on Solana, and 44.2 million OP, on Optimism.
- 2,961.9 ETH in the final transfer, completed at 23:56 UTC.
In 50 signing transactions, the attacker delegated part of a hot wallet's permissions to a smart contract the attacker controlled. Because that wallet relies on multi-party signing, no single key could undo it. Binance removed the delegation at 00:10 UTC on Oct. 30, a little more than four hours after the first transfer.
The company puts the loss at about $6.34 billion. It says $2.85 billion is frozen or intercepted, pending reconciliation, and that 98% of the affected assets had been replaced by Oct. 31, a claim it points readers to its Proof of Reserves page to check. The report omits the dollar value of each asset, so the totals cannot be rebuilt from the quantities it publishes.
Binance cites the FBI statement that blames North Korea and says it stopped 57 suspected North Korea-linked threats in 2026. "This should not have happened," the company writes.
The method is not specific to Binance: all it takes is an employee running, on a work machine, code sent by a supposed recruiter.
