Binance traces its $6.3 billion theft to a fake job interview and a tampered tool

Binance said on November 3 that the $6.3 billion theft began months earlier, with a tampered developer tool in June and a fake job interview in September, according to The Block and CoinDesk.

The exchange's account follows the attribution to North Korea that FinanceInTime reported on November 2, when Binance had only said the attack began with a compromised engineer's laptop. The incident report fills in how that laptop, and others, were reached.

From a tampered package to a container in four steps

The Block, summarizing Binance's initial incident report, wrote that attackers first targeted "a Wallet DevOps engineer in June through a tampered Homebrew installation". CoinDesk described the same step as an engineer who "had installed a tampered Homebrew package while searching for an AI tool". Binance replaced the device, but the engineer's role and colleagues on the wallet team had already been exposed, CoinDesk reported.

In September the attackers moved to a second route. According to CoinDesk, "a software engineer was contacted in September through a legitimate job platform by someone posing as a project director". The Block said the attackers targeted "another employee through a fraudulent recruitment process" and that the process ended with a malicious coding assignment on his work computer.

On October 20, CoinDesk wrote, "attackers used the machine compromised by the fake interview and an internal AI tool". The Block put it more directly: they "used the compromised employee's computer and an internal AI tool to gain control of two other engineers' devices". On October 29, CoinDesk wrote, "they used stolen credentials to deploy a container and run a malicious script".

What the report says about the internal AI tool

Both outlets place the internal AI tool in one step: the move from the engineer who took the fake job interview to two other engineers' devices. The articles we reviewed do not say what the tool is or why it gave that access.

Recovery figures and the 57 earlier attempts

Binance said it had "frozen or intercepted about $2.85 billion in assets and replenished 98% of impacted assets", The Block reported. CoinDesk gave the same replenishment figure as "about 98% of the affected tokens have been replenished with company funds". The $6.3 billion in both headlines is Binance's own round figure; the blockchain analytics firm Elliptic, quoted in our earlier article, put the theft at $6.43 billion, so totals differ by source.

Binance also said it "detected and prevented 57 suspected North Korea-linked cyberattacks throughout 2026", The Block reported, many using similar tactics such as fraudulent interviews and malicious developer tools. Co-CEO Richard Teng wrote on X: "This wasn't one mistake or one breach — it was a months-long campaign."

The weak point was a hiring process, not a wallet

We think the report moves the story from a custody failure to a people-and-tools failure. By Binance's own account as the two outlets report it, the path ran through two ordinary routes, a developer package and a job offer, and then through stolen credentials. That is the threat for any exchange that hires engineers remotely and lets internal tools reach production systems.

The opportunity is that each step was a control the exchange can tighten, and sharing the account, as Binance has done, lets others check theirs. We do not forecast price levels. Our view would change if an independent review, or a later report from the FBI or a security firm, contradicted Binance's timeline.

The view in this final section is FinanceInTime's editorial opinion, for information only. It is not investment, tax, legal or other advice, and it does not take your circumstances into account. Forecasts are uncertain and past results do not guarantee future ones.