Binance said hackers used a fake job interview, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure, leading to a record-breaking cyberattack on October 29 that stole more than $6 billion in assets from the world’s largest cryptocurrency exchange.
Binance co-CEO Richard Teng told CNBC’s “Squawk on the Street” on Tuesday that the attackers “spent months building the breach,” denying that there was a single point of failure on employee laptops.
“In June,[the attackers]set up a fake version of developer tools and lured one of our engineers into installing it,” he added. “In September, they posed as recruiters and conducted a series of interviews with another engineer, which ended up being a coding exercise containing hidden malware designed to circumvent security… From there they gained access to violently move our internal AI tools and compromise the systems that allow our wallet transactions.”
He also said that Binance has replenished 98% of the $6.34 billion in affected assets and is still purchasing more illiquid assets that are outstanding.
Teng himself confirmed that the attack was not caused by North Korea, but that the FBI has linked it to North Korean hackers associated with the TraderTraitor group.
Preparation for June
According to a security report published by Binance on Tuesday, preparation for the attack began in June, when DevOps engineers at Binance Wallet downloaded a compromised Homebrew installation “to install popular AI coding tools after searching on search engines.” The company detected suspicious activity and replaced the engineer’s device and updated his credentials as a precaution, but by then the employee’s “wallet infrastructure team role and associated colleagues had been exposed to the hacker,” the company said.
As Binance seeks to recover from the incident, it temporarily restricted some withdrawals, promised to cover all customer losses, and tapped its own reserves to replenish affected assets. industry partners including Binance and Tether; circle Ripple and Ripple have reportedly frozen approximately $3 billion in assets, but some of the stolen funds continue to move through laundered channels. Coinbase blocked transfers to the compromised wallets and provided direct assistance to Binance.
Although this incident represents a major security breach, Binance maintains that it is financially sound and focused on identifying vulnerabilities, recovering remaining funds, and preventing further attacks.
This hack caused a sharp but short-lived blow to confidence in the entire crypto market, especially compared to previous failures on major exchanges. Investors are now watching to see if Binance can fully restore trust in centralized exchanges.
As of Tuesday, Binance had rebuilt the affected wallet systems and internal AI tools, replaced the compromised devices, retired credentials and tokens associated with the affected engineers, and expanded security scans across employee devices, Teng told Squawk on the Street.
“We have also had independent experts review everything we have done and will continue to strengthen our defenses as the investigation continues,” Teng said. “We are working around the clock with law enforcement and industry partners to track and freeze stolen funds in this area.”
