The first conclusions of the internal investigation opened by Binance to clarify the “hacking” that caused damage of $6.3 billion (€5.65 billion) to the cryptocurrency platform point to the fact that the people responsible for the attack prepared for months a complex operation in which they combined several techniques and even went so far as to organize fake job interviews.
According to the timeline released by the company, the incident began in June, when an infrastructure engineer for wallets downloaded a tampered installation while looking for an AI programming tool. The security team detected the anomaly, replaced the affected device and rotated the credentials, but the engineer’s position and that of his colleagues was exposed to the attacker.
In September, a second engineer was contacted through an official job-search platform by a supposed project director, who arranged two interviews: one by videoconference with a fake Human Resources manager and another by chat with a supposed chief executive officer of a fictitious company. At the end of this last one, he was asked to download onto his work computer a “task,” a repository which, during installation, executed malicious code.
The “malware” replaced a legitimate component of a development tool with a malicious variant capable of executing commands, connecting with a server controlled by the attacker and deleting traces of its activity. The installed protection solutions on the devices did not identify this zero-day malware.
On October 20, the attacker used the compromised device and an internal AI tool to take control of the machines of a DevOps engineer and another software engineer, and found on one of them a token with privileges to deploy containers.
On October 29, between 5:15 p.m. and 7:56 p.m., the attacker accessed the computer of the second engineer, used the stolen credentials, started up a container and activated a malicious script with which he carried out the attack on the wallet-signing operations.
Binance, which claims to have detected and blocked 57 attempts at cyberattacks allegedly related to North Korea so far in 2026, has rebuilt the affected wallet system and the AI tool, replaced compromised devices, revoked credentials and tokens, and strengthened both security analysis as well as anomaly detection and risk controls.
The company has said that it will keep some of the countermeasures it has implemented in reserve in order not to offer clues to potential attackers and that the investigation remains open.