Binance revealed how hackers stole $6.3bn from its cryptocurrency exchange in an operation spanning four months. A company engineer downloaded malware inadvertently in June, exposing wallet infrastructure staff. In September, a fake recruiter contacted a different engineer via a job platform, conducting a two-stage interview that included a fake HR representative and a sham CEO. During the second interview, conducted on a chat app, the engineer was tricked into downloading malware.
On 20 October, the attacker used the compromised computer and an internal Binance AI tool to access systems belonging to the engineer and a second wallet developer on the same team. On 29 October, using stolen credentials from the first engineer, the attacker triggered a malicious script that launched the raid on "hot wallets" containing the crypto-assets.
Binance said $2.85bn of the $6.34bn drained had been frozen or intercepted. The company stated: "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
The FBI blamed North Korea for the heist. Kim Yo-jong, sister of North Korean leader Kim Jong-un, responded on Tuesday through state news agency KCNA, calling the accusation "absurd rhetoric" and describing it as a grave political provocation. She said the US assertion misleads international opinion by attributing all cybercrimes to North Korea.