Binance has published its own account of how attackers drained about $6.3 billion from the exchange on 29 October, and it starts with two ordinary-looking mistakes by engineers. One developer installed a tampered tool that came from a malicious search ad, and another was talked into running a fake job-interview assignment.
The break-in took four months, not one night. The company says its security team caught the first infection in June and replaced the developer’s machine, but the second one, in September, got past its endpoint protection because the malware was brand new.
According to The Verge’s summary of the postmortem, the September target was approached by someone posing as a recruiter. The fake recruiter ran a series of calls and interview rounds and pointed to social media profiles to seem real, then handed over a take-home coding task. That task was the malware. It deleted the engineer’s pyenv programme, a common tool for managing Python versions, and put a malicious copy in its place. That gave the attackers a backdoor and a link to a server they controlled, and they worked to hide their traces.
Binance says the attackers then turned one of its internal AI tools against it. By 20 October they controlled wallets tied to the June victim and to a third employee, and on 29 October they signed in to that third person’s computer and began moving money. Binance has not said what the AI tool does or why it let attackers reach the wallets, and the postmortem leaves that open.
The postmortem also explains why Binance could not halt the transfers, which kept going for almost two hours. Its hot wallet uses multi-party computation, so there was no single private key it could use to cancel the malicious EIP-7702 authorisations the attackers had set up.
Blockchain analysts at TRM Labs said the attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it within about 20 minutes. The FBI has blamed North Korea’s TraderTraitor unit, as the bureau said last weekend, and the same group was behind the $1.5 billion Bybit theft in February 2025.
On recovery, Binance puts the frozen or intercepted total at about $2.85 billion. Chief executive Richard Teng wrote that no user is bearing the loss, that 98% of the affected tokens have been replaced and the remaining 2% is being completed, and that withdrawals have broadly resumed. Earlier, Binance had said it would reopen some withdrawals once most funds were back. The company also says it has stopped 57 other suspected North Korea-linked attempts.
The lesson for anyone who works with code is old but still unlearned: a recruiter who asks you to download and run an assignment on a work machine is a warning sign, however polished the process looks.
