Binance Report Traces $6.3 Billion Hack to June Malware, Fake Recruiters and a Compromised Internal AI Tool

Since hackers drained roughly $6.3 billion from Binance wallets on Oct. 29, the exchange has said little about how they got in. A security report published today, Nov. 3, fills that gap: the attack was months in the making, and it ran through at least three engineers.

How the attackers got in

Binance co-CEO Richard Teng told CNBC the attackers "spent months building their way in." He rejected the idea that one employee's laptop was a single point of failure.

The report lays out the sequence.

June. A Binance Wallet DevOps engineer searched for a popular AI coding tool and downloaded a tampered version of the Homebrew installer. According to the report, he got it from an internet ad rather than through the company's regular channels. Binance says it detected the problem, replaced the engineer's device and rotated credentials. By then, the hackers had learned his role and those of colleagues on the wallet infrastructure team.

September. A second engineer, identified in the report as "Software Engineer B," was contacted through a legitimate job-hunting platform. Fortune reported it was LinkedIn. The report says his profile referenced his Binance experience.

A person posing as a "Project Director" set up a first-round interview with a purported HR representative. A second round followed with someone claiming to be the CEO of a fictitious company. In that second interview, he was told to download a coding "assignment." It carried previously unknown malware that evaded Binance's security software.

Oct. 20. The attackers used the compromised machine and an internal AI tool to reach two more engineers' laptops. They then obtained credentials that let them deploy software inside the wallet infrastructure.

Oct. 29. Using those credentials, they reached the wallet-signing service and bypassed normal withdrawal procedures. The report lists transfers of 18,270 BTC, 233.46 million XRP and about 970,500 SOL, among other assets. It also says the attackers exploited Ethereum's EIP-7702 mechanism.

Who Binance says did it

Teng did not name North Korea himself. He acknowledged that the FBI has tied the attack to TraderTraitor, a North Korean group linked to the Lazarus Group.

North Korea rejects that. Kim Yo Jong, sister of leader Kim Jong Un, said in a statement carried by state agency KCNA that the U.S. claim is "absurd rhetoric and nothing new." She called it "a grave political provocation" meant to brand the country a "cyber criminal state."

The analytics firm Elliptic estimates North Korea stole $7.6 billion in crypto in 2026, more than in any prior year. Binance says it detected and blocked 57 North Korea-related hacking attempts this year.

Money recovered, money still moving

Binance says 98% of the roughly $6.34 billion in affected assets had been replenished as of Saturday, Oct. 31. Teng said the exchange is still buying the remaining, more illiquid assets. The company says it set aside more than 100% of the funds needed to cover the loss.

Freeze numbers vary. Binance's report puts frozen or intercepted assets at about $2.85 billion. Earlier statements said roughly $3 billion. Fortune, citing company executives, reported about $2.5 billion in stablecoins frozen after Tether and Circle moved. Some stolen funds are still passing through laundering channels.

The FBI, Secret Service and IRS criminal investigation unit have asked private-sector services to block transactions from Ethereum addresses TraderTraitor has used. Those addresses are listed on the FBI's website.

What remains unanswered

Binance apologized, saying "this should not have happened." It also says it has rebuilt the affected wallet system and internal AI tool, replaced compromised devices and decommissioned credentials.

The June episode is the awkward part. Binance caught the malicious download and swapped the machine, yet the information that leaked was enough to help set up the later attack.

A Binance spokesperson told Fortune that employees in non-public roles are not allowed to keep LinkedIn profiles. The spokesperson would not say whether the September engineer broke that rule, or whether either engineer would be fired.

The approach is a known one. Security reporting describes a "Contagious Interview" campaign in which fake recruiters hand developers booby-trapped coding tests. It was reportedly active from December 2025 to July 2026 and moved about $10.7 million, according to a joint international advisory. Binance's case is far larger.

Binance has also promised an updated Proof of Reserves once remediation is complete. It has not given a date.

Unresolved are how much of the stolen money can ultimately be frozen, and whether the exchange will say what it did with its own internal controls after June.