Binance, the world’s largest cryptocurrency exchange, said on Tuesday that the hackers behind last week’s $6.3 billion theft had spent months preparing for the heist, luring an employee with a fake job interview and planting tampered software before using the company’s artificial intelligence tool to reach its wallet systems.
Someone posing as a project director contacted a Binance software engineer in September through a job-hunting platform, according to the company’s initial report on the Oct. 29 attack. After two rounds of interviews, including a live video call with someone purporting to be a human resources representative, the engineer was told to download an “assignment” onto his work computer. The file contained malicious code that went undetected by the company’s security tools.
On Oct. 20, the hackers used that computer and an internal Binance A.I. tool to take control of the work computers of two engineers on Binance’s wallet team, one of whom had permissions to deploy software. Nine days later, they used that permission to gain access to a service that signs transactions and began draining the exchange’s hot wallets, which hold assets for quick withdrawals, over nearly four hours.
“This should not have happened,” the company said in the report.
The theft is by far the largest in the history of the crypto industry, which has long been a target for hackers drawn to large pools of digital assets that can be moved across borders in minutes. The previous record was set in February 2025, when hackers stole about $1.5 billion in digital tokens from Bybit, a Dubai-based exchange.
The F.B.I. said on Saturday that the attack was carried out by TraderTraitor, a North Korean hacking unit. North Korea has denied the accusation.
Binance said on Tuesday that halting withdrawals was not enough to stop the attack because the hackers had exploited a feature that let them keep moving funds independently of the company’s systems.
About $2.85 billion has been frozen or intercepted, the company said. Binance said it would cover customers’ losses and that it had already replenished 98 percent of the affected tokens.
The post Binance Says Hackers Plotted $6.3 Billion Heist for Months appeared first on New York Times.
