Binance co-CEO details how hackers stole $6.3B using fake jobs and AI tools

A multi-month infiltration

Binance co-CEO Richard Teng revealed that the record-breaking theft of $6.34 billion was not a single point of failure. Instead, the attackers spent months building their way into the company's infrastructure through a series of coordinated steps. The campaign began as early as June when the hackers successfully targeted a specific engineer.

During that initial phase, a Binance Wallet DevOps engineer downloaded a tampered version of Homebrew, which is a software package manager. The employee was searching for a popular AI coding tool on a search engine when they encountered the malicious installation. While Binance detected the suspicious activity and replaced the device, the hackers had already successfully exposed the engineer's role and their colleagues on the wallet team.

The hackers were persistent and patient, moving slowly to avoid detection while establishing a foothold. By the time the final theft occurred on October 29, the attackers had already mapped out the internal systems. This long-term approach allowed them to identify the specific pathways needed to reach the most sensitive parts of the exchange.

Social engineering and malware

The most sophisticated part of the attack involved direct social engineering, where the hackers posed as recruiters. In September, they contacted another engineer to conduct a series of fake job interviews. These interactions eventually led to a coding exercise that served as a delivery mechanism for hidden malware.

The malware was specifically designed to evade security measures while granting the hackers deeper access to the network. Once the code was executed, the attackers were able to move violently through the company's internal AI tools. This allowed them to reach the system that authorized the actual wallet transactions, leading to the massive theft.

This strategy shows how attackers can exploit the human element of a company to bypass technical barriers. By mimicking legitimate business processes like hiring, the hackers were able to trick a high-level employee into opening a door for the rest of the operation. The use of AI tools as a pathway further complicates the security landscape for large tech firms.

Recovery and financial impact

Binance has taken significant steps to stabilize the situation following the breach. The company has already replenished 98% of the $6.34 billion in affected assets using its own reserves. They have also pledged to cover all customer losses, which helps maintain the confidence of their user base.

While the majority of the funds are back, the company is still working to purchase the remaining outstanding, more illiquid assets. They have also implemented several immediate security measures, including restricting certain withdrawals and replacing compromised devices. These actions are intended to prevent similar breaches while the investigation continues.

The theft caused a sharp but short-lived hit to confidence across the broader cryptocurrency markets. However, Binance maintains that it remains financially sound despite the loss. The company is now focused on identifying the specific vulnerabilities that were exploited and ensuring they are permanently closed.

Industry cooperation and next steps

The response to the hack has involved a wide range of industry partners and law enforcement agencies. Partners including Tether, Circle, and Ripple have reportedly frozen about $3 billion in assets. Meanwhile, Coinbase has blocked transfers to the compromised wallets and offered direct assistance to Binance.

The FBI has linked the attack to the TraderTraitor group, which is tied to North Korean hackers. While Richard Teng did not personally attribute the attack to North Korea, the law enforcement connection provides a clear picture of the threat actors involved. The company is currently working around the clock with these agencies to trace and freeze the remaining stolen funds.

To prevent future incidents, Binance has rebuilt the affected wallet system and the internal AI tool. They have also decommissioned all credentials and tokens associated with the affected engineers. An independent expert is being brought in to review all of these actions to ensure the new defenses are robust enough to withstand future attacks.