Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers.
"It was not a single isolated breach or a simple phishing incident," the company said. "The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method."
The starting point has been traced back to a supply chain attack targeting one of its engineers from the Wallet DevOps team (named "Engineer A"), who downloaded a trojanized Homebrew installer to install a popular artificial intelligence (AI) tool after searching for it on a search engine. The incident occurred in June 2026.
Although Binance said it detected the attack and rotated all related credentials as a precautionary step, the company said information about "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker."
The second part of the attack occurred in September 2026, with the threat actor contacting another engineer (named "Engineer B") via a legitimate job-hunting platform by disguising themselves as a Project Director.
The Project Director persona arranged a first-round interview with a human resources (HR) representative, which was then followed by a second-round interview with an individual claiming to be the CEO of a non-existent company. Binance did not disclose details of the fake company.
Over the course of the first-round video interview, the HR representative shared a social media account, including personal photos and videos posted on the platform, in an attempt to build credibility and establish trust. The second round, on the other hand, took place on a popular social chat app.
"Near the end of the interview, Engineer B was instructed to download an 'assignment' containing a malicious code repository onto his work computer," Binance said. "The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities."
The undetected malware utilized advanced obfuscation and evasion techniques, including substituting a legitimate development tool component with a poisoned version to execute commands and establish communication with an attacker-controlled external server. In addition, the threat actor took steps to cover up tracks by removing forensic artifacts related to the compromise.
The intrusion moved to the next stage on October 20, 2026, when the adversary leveraged Engineer B's compromised computer and abused an internal AI tool to gain control over Engineer A and another Wallet Software Engineer C.
"The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer," Binance explained. "On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack."
The attack ultimately exploited its unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.
In response to the incident, Binance has reconstructed the affected wallet system in a new environment, as well as rebuilt the internal AI tool and access controls. Other steps taken as of November 3 are listed below -
- Replaced affected devices.
- Decommissioned credentials and tokens related to affected engineers.
- Completed enhanced security scans across all employee devices.
- Enhanced AI-based behavioural anomaly detection.
- Strengthened wallet-service risk controls.
- Worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets.
"The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced," Binance said. "We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection."
"We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring."
Since the start of the year, Binance is estimated to have foiled 57 suspected North Korea-linked cyber threat cases, underscoring the persistent nature of the attacks targeting the cryptocurrency industry.
"The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware," Binance said.
Update
Blockchain analysis company Chainalysis has attributed more than $14.3 million in losses over the past 18 months to similar North Korea-linked fake interview schemes, including smaller attacks that helped the attackers hone their tradecraft.
"We've identified dozens of other job interview compromises that have led to wallet compromises," Tom McLouth, a senior intelligence analyst at Chainalysis, said.
The smaller, successive compromises, which led to losses ranging from tens of thousands to millions, allowed North Korean threat actors to perfect and evolve their methodology, ultimately allowing them to pull off the biggest heist in history, the company added.
Across multiple cases, victims have had their private keys stolen from cloud storage following a bogus interview, indicating that the access extended beyond local files.
"These earlier compromises allowed North Korean actors to refine their methods on small targets before deploying them against higher-value targets," Chainalysis said. "Fake interview schemes are just one component of North Korea's lucrative ecosystem, which includes fraudulent IT employment schemes and crypto laundering."
Some of the attacks have also been found to employ tactics like EtherHiding to open a resilient command-and-control (C2) channel between victim computers and adversary-controlled infrastructure. As recently as August 2026, the attackers have been found to use an EtherHiding variant called NullReceiver where the C2 communication instruction is embedded in a made-up destination address that's not controlled by anyone.
Another approach involves adding redundancy by spreading the C2 communication across two blockchains, TRON and Aptos, to direct infected devices to a third blockchain, BSC, to fetch the malware.
"The attacker embeds pointers on TRON and Aptos that point to a transaction on BSC," Chainalysis said. "If the infected machine can't get what it needs from querying TRON, it turns to Aptos as a backup. Either way, it ends up where it needs to be, on BSC, where the payload is stored."
