- North Korean hackers used fake recruitment and malware to breach Binance's systems in 2023
- Attackers exploited internal AI tools to access wallet-signing services and steal $6.34 billion
- Multiple cryptocurrencies including XRP, SOL, OP, BTC, and ETH were transferred to attacker addresses
A fake recruitment process, a compromised software download and access to internal artificial intelligence tools helped North Korean hackers execute a $6.34 billion attack on Binance, according to the Binance's investigation report.
The October 29 incident involved unauthorised access to wallet-signing systems and transfers across several major cryptocurrencies.
The campaign began months before the theft. In June, an engineer downloaded a tampered Homebrew installation while setting up an AI coding tool. Although Binance detected the malware, replaced the device and rotated credentials, the attackers had already gathered information about the wallet team.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
-
Indian Markets Turning Corner After Two Tough Years, Says Sandeep Tandon -
NDTV Profit Ignite 2026: Experts See Opportunity In Equities, Stay Bullish For Long-Term -
Buy Right, Sit Tight Does Not Work for Individual Stocks, Says Dinshaw Irani -
'Worst Is Behind': Quant MF Sees Market Bottom, Flags 'Extreme Euphoria' In Midcaps -
India's Mutual Fund Industry Could Become A $1 Trillion Opportunity, Say Fund Managers -
'Foreign Investors Are Baraatis': Raamdeo Agrawal's Take On LTCG Tax -
Stay Invested Through Market Cycles: Raamdeo Agrawal at NDTV Profit Ignite -
Ramesh Damani Remains Bullish On India For Next 20-30 Years, Sees Bargains Amid Market Weakness -
CAS Came After A Long Consultation Process: SEBI Chairman Tuhin Kanta Pandey AT NDTV PROFIT IGNITE -
Aim To Cut FPI Onboarding Time From Mth To Five Days: SEBI Chairman Tuhin Kanta Pandey AT NDTV PROFI
In September, another engineer was approached through a job-hunting platform by someone posing as a recruiter. After arranging fake video interviews, the attacker sent a technical assignment containing previously undetected malware. It gave the hackers access to the employee's computer.
How Hackers Used Binance's Internal AI Tools?
On October 20, the attackers exploited an internal AI tool to reach a container deployment token. They subsequently deployed a malicious container on October 29, gaining access to the internal wallet-signing service.
Between 20:05 and 20:09 UTC, five hot wallets transferred 233.46 million XRP to an attacker-controlled address. Other transfers included approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
The hackers also exploited Ethereum's EIP-7702 authorisation mechanism to manipulate wallet permissions. A final unauthorised transfer of 2,961.9 ETH was completed at 23:56 UTC.
READ | Binance Hack: Crypto Exchange Says 90% Of Stolen Assets Replenished
Binance Replenishes 98% Of Affected Assets
Binance said approximately $2.85 billion had been frozen or intercepted, subject to reconciliation and market movements. It had replenished 98% of affected tokens by October 31 and set aside more than the amount required to cover the losses.
The exchange said customers would not bear the financial impact. Binance has rebuilt the affected wallet system, replaced compromised devices, revoked related credentials and expanded behavioural monitoring. It is also commissioning an independent security review.
The FBI attributed the attack to North Korea. Binance said it had blocked 57 suspected North Korea-linked threats during 2026.
READ | FBI Points Finger At North Korea For Record $6 Billion Binance Crypto Heist
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
