Binance’s Inside Account of a $6 Billion Theft

Binance has published a detailed account of how attackers prepared and executed the $6.34 billion theft from its platform, tracing the breach back to social engineering and malware planted through a fake job interview process.

The useful number, beyond the headline figure, is that Binance said it has already replenished 98% of affected assets from its own funds, while about $2.85 billion of the stolen total has been frozen. That does not mean the damage is mostly undone. Replacing customer assets is a balance-sheet decision; recovering stolen money is a different matter, and the unfrozen portion is still substantial by any denominator that matters.

According to the exchange, the attackers began laying groundwork in June by targeting a platform engineer with a malicious version of Homebrew, a widely used software tool. Binance said its security team removed that malware, but not before information about the engineer and colleagues had been harvested.

The more consequential step came in September. Binance said another engineer was approached on a legitimate job-search platform for a role at a fictitious company. After trust-building through social media material, the engineer was sent a supposed test exercise that contained malware. Binance said the code used obfuscation and evasion techniques, including swapping in a malicious version of a legitimate development-tool component. In plain English: the attackers did not batter down the front door; they persuaded someone inside to carry in the lockpick.

Binance said the access gained from that compromise was used on October 20, together with an internal AI tool, to take control of software used by two other engineers. The malicious code that initiated the theft was then triggered on October 29 over roughly four hours.

Times of Malta reported that the FBI attributed the attack to North Korea-affiliated hackers. Pyongyang denied that allegation, with Kim Jong Un’s sister calling it “absurd rhetoric.” Attribution in cybercrime is rarely a courtroom verdict when first announced, and state denials are almost costless, but the accusation matters because North Korea-linked theft has become less a niche security problem than a funding model with keyboards.

Binance is the world’s largest crypto exchange by daily trading volume, so the incident landed beyond one company’s perimeter. Times of Malta said prices of major cryptocurrencies fell sharply after news of the attack. Market panic, though, proves fear more than causation. What Binance’s report does establish is narrower and more useful: one of the largest thefts in crypto history began not with some exotic chain exploit, but with employees being fooled one by one.