Cryptocurrency exchange Binance has released a comprehensive forensic report into the largest cryptocurrency theft on record, disclosing that state-sponsored hackers drained $6.34 billion (€5.7 billion) not via elaborate cutting-edge hacking but after duping an employee through a months-long recruitment scam involving fake job interviews and compromised developer tools.
The detailed post-mortem, published on November 3, dismantles early speculation that attackers exploited cryptographic flaws or zero-day vulnerabilities in blockchain protocols.
Instead, the world’s largest digital asset exchange revealed it fell victim to an advanced social engineering campaign attributed by the FBI to North Korea’s state-backed military-intelligence apparatus. Pyongyang has rejected the accusation.
According to Binance’s technical disclosure, the breach began when an attacker posing as a project director approached a Binance software engineer in September on a professional networking platform.
The employee was first put through a video interview with a fake human resources representative, who shared a social media profile with personal photos and videos to establish credibility. A second interview followed with an individual claiming to be the chief executive of a fictitious tech firm.
During the process, the candidate was asked to complete a coding assignment by downloading a software repository that contained disguised malicious code.
Once executed on the engineer’s device, the malware provided attackers with an initial foothold.
— Binance (@binance) November 3, 2026
The intrusion escalated on October 20, nine days prior to the theft.
Using the compromised workstation, the hackers infiltrated the devices of two additional engineers responsible for managing Binance’s wallet infrastructure.
Months earlier, in June, another engineer had inadvertently exposed operational details after downloading a tampered installer for Homebrew, a widely used developer tool, while trying to set up an artificial intelligence coding assistant.
The attackers subsequently exploited an internal AI tool to navigate internal access controls and submit unauthorised automated withdrawal commands across ten separate blockchains. Most of the funds left in about 20 minutes on October 29, according to blockchain analytics firm TRM Labs.
Binance said its security team had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fake job interviews and malware disguised as development tools.
The tactic, catalogued by cybersecurity researchers as “Contagious Interview”, has become a hallmark of North Korea’s Lazarus Group and “TraderTraitor” cyber syndicates. They were previously blamed for the $625 million (€559 million) Ronin network hack in 2022 and the February 2025 breach of rival exchange Bybit, which at $1.5 billion (€1.34 billion) was the previous record.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Binance co-chief executive Richard Teng. The exchange also apologised to users, partners and the wider industry, saying the breach should not have happened.
Industry observers praised the exchange for its transparency in publishing the intrusion pathway.
Dragonfly Capital managing partner Haseeb Qureshi described the disclosure on X as a “tremendous public service”, urging technology and blockchain developers to review the mechanics to guard against escalating human-targeted cyber espionage.
While quick coordination between stablecoin issuers Tether and Circle, along with Ripple and others, froze some $2.85 billion (€2.55 billion) in assets linked to the theft, according to Binance, about $2.4 billion (€2.15 billion) in native assets (primarily Bitcoin and Ether) remains under the perpetrators’ control.
Binance confirmed it has already replenished roughly 98 per cent of affected customer balances using its corporate treasury and internal reserve funds, including its Secure Asset Fund for Users (SAFU), stating that net platform outflows have normalised. The exchange had paused withdrawals for almost two days after the attack.
Nevertheless, the disclosure could intensify regulatory scrutiny under the European Union’s Markets in Crypto-Assets (MiCA) regime, which has applied in full since December 30, 2024. It also tests the Digital Operational Resilience Act (DORA), which since January 17, 2025, has required EU financial firms, crypto-asset service providers included, to manage cybersecurity and ICT risks.
“excellent, now say we cover dental” https://t.co/rEEAK31wf9 pic.twitter.com/HRgVh3ir1u
— log4j (@log4j) November 3, 2026
The case highlights that even well-resourced crypto conglomerates remain vulnerable to basic endpoint intrusions and workforce phishing schemes.
The breach also prompted a warning from Binance founder Changpeng Zhao, who argued that the incident represents a systemic threat extending far beyond digital assets to the legacy banking sector.
Zhao stepped down as chief executive in 2023 after pleading guilty to US anti-money laundering violations and was pardoned by US President Donald Trump in 2025.
Speaking in a wide-ranging interview with CoinDesk following the disclosures, Zhao contended that AI was making attacks easier and that traditional financial institutions may be sleepwalking into even greater danger.
“If a crypto exchange can be hacked, banks are in a worse position,” Zhao warned, urging the industry to use AI to defend itself against AI-driven hacks.
“This is not just a crypto problem. This is actually a much wider information security problem,” he added. Zhao also called for an industry-wide security alliance to share best practices, carry out cross-audits and coordinate faster on freezing stolen funds.
His comparison with banks drew criticism from OKX founder and chief executive Star Xu, who on November 4 accused Zhao of deflecting responsibility for the breach.
