Binance Says a Fake Job Interview and Tampered Software Led to the $6.34 Billion Theft, With 98% Now Replenished
Binance's first incident report traces the October 29 theft through a tampered software download in June, a fake job interview in September and an internal AI tool in October, and the exchange says it has replenished 98% of the affected assets from its own funds.
Binance says a months-long intrusion that began with a tampered software download and a fake job interview led to the theft of about $6.34 billion in digital assets on Oct. 29, and the exchange says it has now replenished 98 percent of the affected assets from its own funds. The account comes from Binance’s Nov. 3 incident report, as summarized by ReversingLabs and Gagadget, and the company says customers lost nothing.
According to Binance, a Wallet DevOps engineer downloaded a tampered Homebrew installation in June while trying to install an AI coding tool. The device was replaced, but the attackers learned about the engineer’s role and colleagues. In September, a second engineer was approached by a fake recruiter and downloaded a coding assignment that contained malicious code. By Oct. 20, Binance says, the attackers used the compromised workstation and an internal AI tool to reach two more engineering systems, gaining credentials and a container deployment token. On Oct. 29, they used that access to reach the wallet signing setup and move funds.
Attribution and frozen funds
The FBI attributed the theft on Oct. 31 to TraderTraitor, a North Korea-linked group it also blamed for the $1.5 billion Bybit theft in 2025. North Korea has denied responsibility. ReversingLabs, summarizing third-party tracking, reported that Tether and Circle froze 971 million USDT and 823 million USDC in the hours after the theft, with roughly $3 billion frozen in total. Chainalysis put frozen assets at about $2.8 billion as of Nov. 3, according to Gagadget.
Binance says it has rebuilt affected systems, replaced compromised devices, revoked exposed credentials and scanned company devices. Its investigation and an independent review are still under way, and the 98 percent figure can be checked against the exchange’s proof-of-reserves page, according to Gagadget. Binance has not yet published a full technical postmortem, and ReversingLabs notes that not every step in the timeline has been confirmed by outside researchers.
Reporting based on coverage by ReversingLabs and Gagadget.
