Crypto Heist: $6.3 billion stolen via poisoned downloads and fake interviews

A $6.3 billion cryptocurrency heist, described by Binance as the largest theft of its kind, concluded after a multi-month campaign that combined software poisoning with social engineering. The exchange released a detailed postmortem on Monday, outlining how attackers exploited human error and technical gaps to drain assets over several months.

The intrusion began in June when a Binance developer downloaded a tampered installer spread through a malicious Google advertisement. The company stated that its security teams detected this initial malware installation and replaced the employee's device. However, a second vector emerged in September when an attacker posed as a recruiter targeting another engineer. The fake interviewer conducted multiple calls and shared social media profiles to build trust, eventually convincing the target to download a fake interview assignment that contained malware.

This second infection evaded endpoint security tools because the malware deleted the pyenv executable and installed a malicious version that provided a backdoor. The attackers concealed their activity and removed traces of the compromise. By October 20, the group, identified by the FBI as the North Korean unit TraderTraitor, used Binance's internal AI tool to control wallets belonging to the engineer compromised in June and a third employee. On October 29, the attackers logged into the third employee's computer to launch the final extraction.

Binance explained that a technical limitation in its hot wallet prevented an immediate stop to the unauthorized transactions. The wallet used Multi-Party Computation, meaning there was no single private key available to instantly revoke the malicious authorizations. This gap allowed transfers to continue for nearly two hours after the first unauthorized movements.

CEO Richard Teng stated that no user is bearing the loss of the theft. The company has frozen or intercepted approximately $2.85 billion in stolen assets. Teng added that 98% of the impacted tokens have been replenished, with the remaining 2% currently in the process of completion. Withdrawals have broadly resumed for customers.

The report notes that Binance has prevented 57 suspected cyber threat cases linked to North Korea in the past. The postmortem leaves open questions regarding why the internal AI tool facilitated the attack and why the job interview scheme succeeded despite known risks. The company provided limited detail on the specific vulnerabilities of that internal tool.

The attack highlights the intersection of digital security and human interaction, relying on trusted channels like job interviews and internal software to bypass traditional defenses. The timeline spans from the initial June intrusion to the October execution, demonstrating a sustained effort to compromise the exchange's infrastructure.