Binance, the largest cryptocurrency exchange globally, has unveiled a thorough investigation into the staggering $6 billion heist that shook the crypto world. The incident, which occurred on October 29, 2026, involved hackers employing fake job interviews and malicious software to infiltrate the platform.
Details of the Hack Revealed
According to Binance, they have successfully replenished 98% of the stolen assets using their own funds, with the remaining amount tied to less frequently traded currencies that are more challenging to recover. The FBI has attributed the hack to cybercriminals associated with North Korea, although the North Korean government has dismissed these claims as “absurd rhetoric.”
Of the $6.34 billion taken, approximately $2.85 billion has been frozen, preventing the attackers from using or converting it into other currencies. This incident is now considered one of the largest hacks in the history of cryptocurrency exchanges.
How the Hackers Operated
Binance reported that the attackers initiated their breach as early as June. They first targeted a platform engineer by tricking them into downloading a compromised version of the popular programming tool Homebrew. Although Binance’s cybersecurity team detected and removed the malware, the hackers managed to gather sensitive information about the engineer and their colleagues.
In September, the hackers took a more deceptive approach by contacting another Binance engineer through a legitimate job search website, luring them with a fake job interview at a non-existent company. By establishing trust via social media interactions, they convinced the engineer to download a test exercise that contained sophisticated malware. This malware was pivotal, as it replaced a legitimate development tool with a harmful version, allowing the hackers to connect to Binance’s internal systems.
On October 20, leveraging the access gained, the attackers utilized an internal AI tool to control software used by two additional engineers. Just nine days later, they executed the malicious code that led to the massive breach.
