How Social Engineering Paved the Way for Binance’s $6.3 Billion Hack

Set Trending Topics as a preferred source on Google.

A job interview, a take-home assignment and $6.3 billion gone: Binance has just released the initial findings of its investigation into the largest crypto theft in history. The attackers spent months targeting the exchange’s employees, including with a fake job interview, the company said. The F.B.I. has blamed TraderTraitor, a hacking group linked to North Korea, while Pyongyang denies any involvement.

According to Binance, digital assets worth about $6.34 billion (about €5.7 billion) were affected. About $2.85 billion of that has been frozen or intercepted so far. Binance has pledged to cover the entire loss itself and says it has already replaced 98 percent of the stolen tokens from its own funds. “This should not have happened,” the company wrote.

From Fake Recruiter to Wallet Server

Binance said the attack was neither a single isolated breach nor a simple phishing incident but a multistage campaign. The attackers combined fake recruitment interviews, tampered software, compromised internal A.I. tools and an advanced method for authorizing transactions. Here is how the attack unfolded, according to Binance:

• June: An engineer on the wallet team searched for a popular A.I. coding tool on a search engine and downloaded a tampered Homebrew installation. The security team detected the anomaly, replaced the device and rotated all related credentials. But the attackers now knew his role and who his colleagues on the wallet team were.
• September: Through a legitimate job-hunting platform, a person posing as a project director contacted a second software engineer whose profile mentioned his experience at Binance. In a first video interview, a supposed H.R. representative shared her social media account, including personal photos and videos, to build trust. Binance called the approach more advanced and deceptive than any social engineering it had seen before.
• The assignment: In the second round, held over a chat app with the supposed chief executive of the fake company, the engineer was told to download an “assignment” onto his work computer. The code repository contained malware that ran during setup and replaced a component of the developer tool pyenv with a malicious version. The endpoint security software failed to detect the previously unknown malware, and the attackers covered their tracks.
• Internal A.I. as a springboard: About a week before the theft, the hackers used the compromised laptop and an internal Binance A.I. tool to take control of the computers of the first engineer and a third colleague. On the first engineer’s machine, they found a token that allowed them to deploy containers.
• The day of the attack: The attackers logged onto the third engineer’s computer, used the stolen credentials to deploy a container and launched a script. That gave them access to an internal wallet signing service, allowing them to initiate transactions outside the normal withdrawal process.

Four Minutes, 233 Million XRP

From there, things moved fast. Within four minutes, five Binance hot wallets sent 233.46 million XRP to an address controlled by the attackers, followed by about 970,500 SOL, 44.2 million OP and 18,270 Bitcoin. On Ethereum, the hackers abused a mechanism called EIP-7702 to give a smart contract they controlled execution rights over a Binance hot wallet.

That made the attack hard to contain. Binance halted withdrawals, but the malicious authorizations sat directly on the blockchain and worked independently of the exchange’s own infrastructure. Because the wallet was secured with multiparty computation, there was no single private key that could revoke the authorizations right away, and the team had to develop a special procedure first. The last unauthorized transfer went through almost four hours after the first outflow. Binance said it had found no evidence that any private keys were stolen.

The F.B.I. and Chainalysis Point to North Korea

On Saturday, the F.B.I. blamed the attack on TraderTraitor, a group linked to North Korea. According to the F.B.I., the same group was behind the February 2025 hack of the crypto exchange Bybit, in which $1.5 billion (about €1.35 billion) disappeared. The blockchain analytics firm Chainalysis also attributes the attack to TraderTraitor. Its strongest evidence: Funds stolen from Binance commingled on-chain with loot from the Bitget hack in September, which has also been attributed to North Korea.

Chainalysis also described how the attackers raced against the clock. Because stablecoins like USDT and USDC can be frozen, they swapped $325 million worth of stablecoins into Ether in just under 20 minutes. About an hour after the first outflows, Tether, Circle and others began freezing funds. Chainalysis is also seeing new laundering patterns: thousands of transactions in a short period, with many addresses first receiving exactly 1 TRX before more funds arrive. That points to an automated process, the firm said.

Binance is not the only exchange in North Korea’s sights. After Bybit and Bitget, Mercado Bitcoin, Brazil’s largest crypto exchange, was hit recently as well. Binance itself says it has detected and blocked 57 suspected North Korean attacks this year, ranging from fake job interviews to tampered developer tools and fake video conferencing apps. “We intercepted many of them, but the cost of failing to stop even one was severe,” Yi He, Binance’s co-chief executive, told The Financial Times.

Pyongyang Calls It a Provocation

North Korea rejects the accusations. Kim Yo Jong, the sister of the country’s leader, Kim Jong Un, called the F.B.I.’s attribution a “grave political provocation” in a statement carried by the state-run Korean Central News Agency. Washington was trying to mislead international opinion by blaming North Korea for cybercrimes around the world, she said. According to Decrypt, she even suggested that the United States itself could be behind the theft, pointing to the Trump administration’s plans to hold seized cryptocurrency in a strategic reserve. Whoever ends up with the so-called stolen coins will show who is responsible, she said. North Korea has denied previous hacking accusations as well.

What Binance Is Changing

Binance has rebuilt the affected wallet system in a new environment, rebuilt the internal A.I. tool and its access controls, replaced all affected devices and revoked related credentials. It has also tightened device controls and expanded A.I.-based detection of behavioral anomalies. Outside security firms are to review its findings independently. Binance also plans a security research fund and initiatives with A.I. companies focused on A.I. security in blockchain environments. Some technical details will remain confidential, the exchange said, so attackers cannot use them to plan future attacks.