Binance has disclosed that hackers used fake job interviews, malicious software and compromised internal artificial intelligence tools to infiltrate its wallet infrastructure in a cyberattack on October 29 that resulted in the theft of more than $6bn in digital assets.
The cryptocurrency exchange said the attackers spent several months gaining access to its systems before executing what has been described as the largest cryptocurrency theft on record.
Binance co-CEO Richard Teng disclosed the details during an interview on Tuesday, according to CNBC.
According to Teng, the attackers “spent months building their way in”, dismissing suggestions that the breach resulted from a single point of failure involving an employee’s laptop.
“In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that,” he added. “In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security … from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction.”
Teng also disclosed that Binance had replenished 98 per cent of the $6.34bn in affected assets, adding that the exchange was still purchasing the remaining less liquid assets.
He did not directly attribute the attack to North Korea but acknowledged that the United States Federal Bureau of Investigation had linked the incident to North Korean hackers associated with the TraderTraitor group.
The attack triggered a sharp but short-lived decline in confidence across cryptocurrency markets, although its impact was less severe than that of previous failures involving major exchanges. Investors are now watching whether Binance can fully restore confidence in centralised cryptocurrency platforms.
Teng told CNBC’s Squawk on the Street on Tuesday that Binance had rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices and deactivated credentials and tokens linked to the affected engineers.
He added that the exchange had expanded security scans across employees’ devices as part of measures to strengthen its cybersecurity systems.
