The Binance hack has become one of the most closely watched cyber incidents in the crypto industry. According to Reuters, hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers. They then used a third engineer’s computer to drain $6.3 billion worth of crypto. The theft happened last week and is described as a record heist.

On Tuesday, Binance published its first report on how it happened. It describes a multi-stage attack that began in June.

A Tampered Tool Opens the Door in June

The story starts in June. An employee on the wallet developer team downloaded a tool from the internet. Hackers had tampered with it.

Binance says it detected the problem afterwards. It replaced the device and changed credentials. But the employee’s role, and those of others on the wallet team, were still exposed.

A person familiar with the incident told Reuters that the malicious version of the tool had been placed in an advertisement. That helped it appear higher in a search engine than the real version.

A Fake Interview in September

The next step came in September. A second software engineer was looking for a new job. After interviewing for what they thought was a legitimate role, the engineer downloaded a “malicious code repository” onto their computer.

The interview included a virtual meeting with the CEO of a fictitious company, according to Binance’s report.

Fake job interviews are a well-known hacking technique. Michael Barnhart, a researcher at cybersecurity firm DTEX, said experts and government officials have warned about them for years. North Korean and other hackers have used them to target employees at companies of interest.

Control of Wallet Systems

On October 20, the attacker used the compromised computer and an internal AI tool. This gave the attacker control of the wallet developer’s system. It also gave control of a second wallet developer’s system.

Nine days later, the attacker used the second developer’s computer. The attacker also had stolen credentials from the first wallet developer. From there, the attacker triggered a malicious script to launch the attack.

Only a limited number of engineers at the company have direct access to wallets, the person familiar with the hack said. Wallets store or trade crypto.

Crypto Removed in Minutes

The attack unfolded quickly on October 29. It removed 233.46 million XRP from five Binance hot wallets. Hot wallets are connected to the internet. The funds went to an attacker-controlled address in just four minutes.

Attackers then withdrew other cryptocurrencies, including bitcoin, the exchange said.

Binance received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised permissions. This resulted in about $2.85 billion of frozen assets.

However, suspending withdrawals alone could not stop all unauthorised asset movements.

A Response Slowed by New Procedures

Attackers used 50 signing transactions to manipulate the account. Binance said it had to build new procedures to revoke authorisations. This slowed its response.

The final unauthorised transfer took place at 2356 GMT. That was nearly four hours after the attack began.

Binance detected the attack late on Thursday. Even as it worked to lock down its system and freeze withdrawals, the hackers kept taking crypto.

Attribution and Customer Repayment

The FBI has blamed a North Korean hacking group for the theft. North Korea has rejected the claim.

Binance says it is repaying all customers whose funds were stolen.

The Binance hack has raised questions about how attackers breached the world’s largest crypto exchange. It follows years of North Korea-linked attacks that have grown in ambition and frequency. It has also renewed concerns about the vulnerability of digital assets to cybercrime.

Binance said it detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. Barnhart said this shows Binance is “just getting barraged.”

Binance’s Next Steps

In its report, Binance apologised. It said the incident “should not have happened.” It also apologised for the concern, disruption and uncertainty caused to users, partners and the wider industry.

As a result of the attack, Binance says it is increasing investment in AI-enabled detection. It is also working on a security research fund and targeted initiatives with AI companies.

Final Takeaway

The Binance hack shows how a single download, a search ad and a fake interview can open the door to a record theft. Binance has laid out the timeline from June to October 29. The details show how patient the attackers were and how quickly the final theft unfolded.

Related post

View all