Binance Traces $6.3 Billion Theft to a Months-Long Intrusion Using Fake Recruiters and an Internal AI Tool

Binance has said it covered $6 billion of the $6.3 billion stolen from its platform, and the attack traces back to an intrusion that began in June. The FBI has identified the actors as a North Korean unit it calls TraderTraitor.

According to Binance, the chain started when one developer downloaded a tampered installer spread through a malicious Google ad. Binance's security teams detected the first malware installation that month and replaced the worker's device. The company said the June compromise also exposed details about its engineers and how they work.

In September, attackers targeted a second engineer while posing as recruiters. They ran a series of calls and several rounds of interviews, shared social media pages to build trust, and then asked the engineer to download a fake interview assignment. That assignment was malware. Binance said its endpoint security tools did not detect the resulting attack, which deleted the pyenv executable and replaced it with a malicious version that provided backdoor access. The company described the code as using obfuscation and evasion, including the replacement of a legitimate development tool component so it could run commands and communicate with an attacker-controlled server. Binance said the zero-day malware went undetected by endpoint protection at the time, and that the attacker removed traces to hinder detection and investigation.

By October 20, the attackers had used Binance's own internal AI tool to gain control of wallets belonging to the engineer compromised in June and to a third employee. On October 29 they logged into that third employee's computer and launched the attack. Wired reported that the theft was pulled off in just 20 minutes. Binance said the hot wallet used Multi-Party Computation, so there was no single private key it could immediately revoke to cancel the malicious EIP-7702 authorizations. Unauthorized transactions continued for nearly two hours after the first unauthorized transfers before Binance could stop them.

Several crypto-tracing firms said TraderTraitor may be behind the heist, according to Wired. The FBI's alert names the North Korean unit as responsible. Binance said it has prevented 57 suspected North Korea-linked cyber threat cases.

On recovery, Binance CEO Richard Teng said about $2.85 billion in stolen assets had been frozen or intercepted and that no user is bearing the loss. He said 98% of impacted tokens had been replenished and that withdrawals have broadly resumed. Reuters described the theft as the largest crypto hack in history, and Reuters describes Binance as the world's biggest cryptocurrency exchange.

In my view, the sequence matters as much as the headline figure. The initial foothold was a developer workstation, the lateral path ran through recruiting-themed social engineering and a development toolchain, and the final step went through an internal AI tool that touched wallet control. Custody keys were not the first point of failure. The workflow around the engineers was.

The broader context here is that MPC custody changed the response problem. With no single key to rotate, the operational question became how quickly authorizations could be revoked and transfers halted, and Binance's account of nearly two hours of continued transactions puts that question at the center of the incident. Teng's figures on frozen assets and replenished tokens describe what recovery looked like after that gap. Whether the recovery figures hold will depend on the continued work of the investigation and the freezing process.

What this enables is a clearer map of where exchange security now has to reach: endpoint integrity on engineering machines, verification of inbound recruiting contacts, and tighter control over what internal AI tooling can authorize. Those are concrete engineering tasks, and the incident gives other custodians a detailed set of failure points to test against.