SAN FRANCISCO, Nov 4 – Binance has revealed that hackers spent several months preparing a massive cyberattack that resulted in the theft of approximately US$6.3 billion (RM25.66 billion) in cryptocurrency.
The world’s largest cryptocurrency exchange said the attackers used fake job interviews, malicious software and an internal artificial intelligence (AI) tool to gain access to its systems.
According to Binance, the operation began as early as June. Hackers first targeted an engineer by tricking the employee into downloading a modified version of a popular software tool.
The attackers later approached another software engineer through a legitimate job recruitment platform in September.
They posed as representatives of a fictional company and arranged several job interviews. During the process, the employee was asked to download a coding assignment onto a work computer.
However, the file contained malicious software that managed to bypass the company’s security systems.
Hackers Used AI to Access Binance Systems
On October 20, the attackers used the compromised computer and an internal Binance AI tool to gain control of two engineers’ work computers.
One of the affected employees had permission to deploy software within the company’s systems.
Nine days later, the hackers used those permissions to access a service responsible for approving cryptocurrency transactions.
They then began transferring funds from Binance’s hot wallets over nearly four hours.
Hot wallets are digital cryptocurrency storage systems connected to the internet. They allow exchanges to process transactions and withdrawals quickly.
Binance acknowledged the seriousness of the incident, stating that the attack should never have happened.
Hackers Moved Stolen Funds Across 12,000 Wallets
The investigation also revealed that the attackers moved stolen cryptocurrency through approximately 12,000 digital wallets.
According to cryptocurrency analytics firm Elliptic, this was an attempt to hide the movement of funds and avoid recovery efforts.
Binance said the hackers exploited a feature linked to its Ethereum account system. This allowed them to continue moving funds even after the exchange attempted to stop withdrawals.
The company explained that its existing security arrangement made it difficult to immediately remove the attackers’ access.
Engineers eventually developed a workaround to contain the attack.
US$2.85 Billion in Stolen Cryptocurrency Frozen
Binance said approximately US$2.85 billion (RM11.61 billion) of the stolen cryptocurrency had been frozen or intercepted.
The company also confirmed that it would cover customer losses. It has already replenished approximately 98% of the affected tokens.
The exchange has since rebuilt the compromised systems and replaced affected computers.
It also plans to bring in independent cybersecurity firms to investigate the incident and strengthen its security measures.
FBI Links Attack to North Korean Hackers
The Federal Bureau of Investigation (FBI) identified the North Korean hacking group TraderTraitor as responsible for the attack on October 31.
However, North Korea has denied the accusation.
Binance also revealed that it had detected and blocked 57 other suspected North Korean hacking attempts this year.
The incident highlights growing cybersecurity risks facing cryptocurrency exchanges, particularly as hackers use increasingly sophisticated methods to target employees and digital financial systems.
The latest attack is considered the largest cryptocurrency theft in history. It surpasses the US$1.5 billion hack involving cryptocurrency exchange Bybit in February 2025.
Source : BERNAMA | Rewritten By Minutesmy
