Binance says its security team detected and stopped 57 suspected North Korea-linked cyber threat cases in 2026 before one attack got through, using a fake job interview, and drained its hot wallets.
The exchange disclosed this in its initial report on the breach, posted on X. It said about $6.34 billion in digital assets was affected, and about $2.85 billion has been frozen or intercepted. Binance said it will absorb the loss, not its users, and that 98% of the impacted token assets have been replenished and can be verified on its Proof of Reserves page.
Citing the latest information from the Federal Bureau of Investigation (FBI), Binance said North Korea is responsible for the incident.
A year of attempts on Binance
The exchange said the 57 cases reflect the persistent threat of state-sponsored actors targeting the crypto industry. The techniques included fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing apps, and social engineering campaigns meant to steal credentials or deploy remote access malware.
Similar read: North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever
The exchange described the breach as a multi-stage campaign, not a single isolated breach or a simple phishing attempt. It traced the first warning sign to June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while looking for an AI coding tool. Binance said it detected the anomaly, replaced the device and rotated the related credentials. However, the engineer’s role and his colleagues on the wallet team had already been exposed to the hacker.
How the interview worked
In September, a second engineer was approached on a job-hunting platform by someone posing as a project director. His profile there referenced his experience at Binance. A first-round video interview followed with a purported HR representative, who shared a social media account with personal photos and videos to build trust. Binance called this more deceptive than earlier social engineering approaches.
The second round took place on a popular chat app with someone claiming to be the CEO of a fictitious company. Near the end, the engineer was told to download an “assignment” onto his work computer. The code in it ran during setup and opened a channel to an attacker-controlled server. Binance said the zero-day malware was not detected by its endpoint security tools at the time.
The attacker then used the compromised computer and an internal AI tool to gain control over two other wallet engineers. Binance said a container deployment permission token found on one engineer’s machine was used on the day of the attack to deploy a container and trigger the malicious script.
Why containment took time
Binance said the attackers used the signing service to exploit Ethereum’s EIP-7702 authorisation mechanism, which kept moving assets even after withdrawals were suspended. Because the hot wallet used multi-party computation (MPC), there was no single private key to revoke the malicious authorisations, so the team built a specialised procedure that took extra time.
The exchange said it has since rebuilt the affected wallet system and internal AI tool, replaced affected devices, decommissioned related credentials and strengthened its anomaly detection. It also plans an independent security review, and some technical details will stay confidential.
Binance described its report as initial, so its findings are still subject to independent review.
Read more: Brazil’s largest crypto exchange, Mercado Bitcoin, halts withdrawals after suspected $40m hack
Technext Newsletter
Get the best of Africa’s daily tech to your inbox – first thing every morning.
Join the community now!
