Binance co-CEO Richard Teng said hackers used fake job interviews, malicious software and compromised internal AI tools to breach the exchange’s wallet infrastructure in an October 29 attack that resulted in more than $6 billion in stolen assets. Binance said it has replenished 98% of the $6.34 billion in affected assets and is still working to acquire remaining, less liquid assets.
Teng told CNBC that the attackers had spent months establishing access, pushing back on suggestions that the breach stemmed from a single employee’s laptop. In June, attackers reportedly created a fake version of a developer tool and persuaded an engineer to install it. In September, they posed as recruiters and set up interviews with another engineer, whose coding exercise contained hidden malware.
A Binance security report said the June incident began when a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for a popular AI coding tool. The exchange detected suspicious activity, replaced the engineer’s device and rotated credentials, but said the employee’s role and connections to colleagues on the wallet infrastructure team had already been exposed.
Binance has temporarily restricted some withdrawals, pledged to cover customer losses and used its reserves to replenish affected assets. Binance and industry partners including Tether, Circle and Ripple have reportedly frozen about $3 billion, although some stolen funds continue to move through laundering channels. Coinbase also blocked transfers to compromised wallets and offered assistance.
Teng said Binance had rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned related credentials and tokens, and expanded security scans of employee devices. The exchange is also commissioning an independent review and working with law enforcement and industry partners to trace and freeze funds.
Teng did not attribute the attack to North Korea, but said the FBI had linked it to North Korean hackers associated with the TraderTraitor group. Binance said it remains financially sound as it works to identify the vulnerability and recover the remaining funds.
Sources: CNBC Markets.