Binance co-CEO Richard Teng says attackers used spoofed developer tools, fake recruitment interviews, malware and internal AI tools to penetrate the exchange’s systems before stealing more than $6.3 billion in crypto assets from its wallet infrastructure on Oct. 29. Binance puts the total affected assets at $6.34 billion and says it has recovered 98%. Work continues to replace the remainder, particularly less liquid assets.
The incident has drawn attention to wallet authorization processes, employee device security and access controls for internal tools at large centralized exchanges. Binance says it has rebuilt the affected wallet systems and internal AI tools, and will have independent experts review its response.
Binance traces attack preparations to June
In a security report released Tuesday, Binance said preparations for the attack may date back to June. An engineer working on DevOps for Binance Wallet searched online for a popular AI coding tool and downloaded a tampered Homebrew installer.
Binance said it replaced the engineer’s device and rotated relevant credentials after detecting suspicious activity as a precaution. But the report says attackers had already obtained information about the employee’s role and colleagues on the wallet infrastructure team before those steps were taken.
Teng said the attackers spent months building access. He rejected the idea that the incident resulted from a single point of failure involving one employee’s laptop, saying the attackers also targeted another engineer in September.
Fake recruitment interviews introduced malicious code
Teng said the attackers posed as recruiters in September and conducted a series of job interviews with an engineer. During the process, the engineer received a coding test containing malware designed to bypass security protections. The attackers then used Binance’s internal AI tools to expand their activity and gained access that allowed them to get around the wallet transaction authorization system.
The account suggests the attackers did not rely on a single compromised device, but advanced through a combination of personal contact, software installation and access to internal systems. Binance said it disabled affected devices and revoked credentials and tokens associated with the engineers involved. It has also expanded security scans across employee devices.
98% of affected assets recovered; some withdrawals restricted
Binance says it has recovered 98% of the affected assets and is buying assets that have not yet been replaced, including less liquid tokens. After the incident, the platform temporarily restricted some withdrawals, pledged to cover customer losses and used its own reserves to replenish the affected assets.
Industry participants including Tether, Circle and Ripple worked with Binance and others to freeze about $3 billion in assets. Some of the stolen funds were nevertheless moved through money-laundering channels. Coinbase said it blocked transfers to affected wallets and provided direct assistance to Binance.
Teng did not directly attribute the attack to North Korea, but acknowledged that the FBI had linked the incident to North Korean hackers and the TraderTraitor group. Attribution remains part of the investigation. Binance said it is working with law enforcement and industry partners to trace and freeze the stolen funds.
Independent experts to review Binance’s response
Teng said Binance will appoint independent experts to review its handling of the incident and will continue strengthening its defenses while the investigation proceeds. The exchange says it has rebuilt the affected wallet systems and internal AI tools, replaced affected devices, revoked relevant credentials and tokens, and widened scans of employee endpoints.
The attack briefly tested confidence in centralized crypto exchanges. Binance says its finances remain strong and that its priorities are identifying vulnerabilities, recovering the remaining assets and preventing a similar incident. Users and markets will be watching the recovery of the outstanding assets, where the remaining funds have moved and the findings of the independent review.