Binance Details $6.3 Billion Crypto Heist Involving Fake Interviews and Compromised Internal AI Tool
Binance released a postmortem explaining how North Korean hacker group TraderTraitor executed a $6.3 billion attack using malicious Google ads, fake job assignments, and the company's internal AI system.
Cryptocurrency exchange Binance has published a postmortem detailing how hackers executed the largest crypto theft to date—a multi-month heist totaling $6.3 billion. According to the company, the attack combined search engine malware, a sophisticated social engineering scheme disguised as a job recruitment process, and unauthorized access to Binance's own internal AI tool.
Federal authorities, including the FBI, have attributed the breach to a North Korean cyber unit known as "TraderTraitor."
A Multi-Stage Attack Plan
According to Binance, the breach unfolded across several months, beginning in June. The initial compromise occurred when a developer downloaded a tampered installer delivered via a malicious Google ad. Although Binance's security teams detected the initial malware and replaced the affected employee's device, the attackers managed to gather critical intel regarding internal engineers and technical workflows.
In September, the threat actors initiated a second phase targeting another engineer under the guise of job recruitment. Posing as a potential employer, the attacker scheduled multiple interview rounds, held calls, and shared social media links to build trust. Eventually, the fake employer persuaded the engineer to download a technical assignment, which contained zero-day malware.
The security tools failed to detect the second payload, which replaced the standard pyenv executable with a modified, malicious version. This component gave the attackers backdoor access and allowed them to establish communication with an external command server while obfuscating their tracks.
Internal AI System Exploited
By October 20, the attackers leveraged Binance's internal AI tool to gain control over the wallets belonging to the engineer compromised in June, as well as a third employee. On October 29, the hackers logged directly into the third employee's workstation to launch the main attack.
The theft continued for nearly two hours after the initial unauthorized transfers were detected. Binance explained that the delay in halting transactions stemmed from its hot wallet architecture, which uses Multi-Party Computation (MPC). Because MPC distributes authorization, there was no single private key available to immediately revoke the attackers' unauthorized EIP-7702 authorizations.
Recovery Efforts and Impact
Binance CEO Richard Teng stated that users will not bear the financial losses from the breach. Approximately $2.85 billion in stolen assets have been frozen or intercepted by security teams and partners.
Teng confirmed that 98 percent of impacted tokens have already been replenished, with work ongoing to complete the remaining 2 percent, allowing withdrawals to broadly resume. Binance also noted that its defenses have successfully thwarted 57 other suspected cyber threat cases linked to North Korea in the past.
Despite the published findings, questions remain regarding how the internal AI tool was designed and how it granted the attackers sufficient leverage to compromise internal wallet controls.
