Binance says hackers plotted US$6.3 billion heist for months

[SAN FRANCISCO] Binance, the world’s largest cryptocurrency exchange, said on Tuesday (Nov 3) that the hackers behind last week’s US$6.3 billion theft had spent months preparing for the heist, luring an employee with a fake job interview and planting tampered software before using the company’s artificial intelligence tool to reach its wallet systems.

Someone posing as a project director contacted a Binance software engineer in September through a job-hunting platform, according to the company’s initial report on the attack.

After two rounds of interviews, including a live video call with someone purporting to be a human resources representative, the engineer was told to download an “assignment” onto his work computer. The file contained malicious code that the company’s security tools failed to detect.

On Oct. 20, the week before the theft, the hackers used that computer and an internal Binance AI tool to take control of the work computers of two engineers on Binance’s wallet team, one of whom had permissions to deploy software.

Nine days later, they used that permission to gain access to a service that signs transactions and began draining the exchange’s hot wallets, which hold assets for quick withdrawals, over nearly four hours.

The report is the most detailed account to date of by far the largest theft in the history of the crypto industry, which has long been a target for hackers drawn to large pools of digital assets that can be moved across borders in minutes.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

The hack is also the latest blow to Binance, which has a history of legal trouble.

In 2023, Binance pleaded guilty to breaking US anti-money-laundering laws and paid US$4.3 billion in penalties. Binance’s founder, crypto billionaire Changpeng Zhao, served four months in federal prison and later got a pardon from President Donald Trump.

On Saturday, the FBI said the attack on Binance was carried out by TraderTraitor, a North Korean hacking unit. North Korea has denied the accusation. Binance said it had caught and blocked 57 other suspected North Korean hacking attempts this year alone.

SEE ALSO

Binance loses market share to crypto exchange rivals after hack

North Korea says US allegations linking it to Binance heist are ‘absurd rhetoric’, KCNA says

North Korea’s hackers supercharge crypto heists with AI skills

Binance sees spike in withdrawals as exchange returns online after US$6.3 billion heist

More

Binance said that it would cover customers’ losses and that it had already replenished 98 per cent of the affected tokens.

Binance said it had rebuilt the hacked systems, replaced compromised computers and would bring in outside security firms to review the attack. It also said it was working to set up a security research fund and was teaming up with AI companies to better protect crypto systems. NYTIMES