Photo Credit:arabianbusiness.com
Binance has disclosed details of a four-month cyberattack in which hackers allegedly used fake recruitment interviews, malware and stolen employee credentials to carry out a $6.34 billion cryptocurrency theft.
According to the exchange, the operation began in June and reached its final stage in October, targeting engineers responsible for maintaining its digital wallet infrastructure. The attackers combined social engineering with malicious software to gain access to internal systems and eventually compromise transaction authorisation controls.
The company said the hackers studied employees’ professional backgrounds, approached them through recruitment platforms and created convincing job opportunities to persuade them to install malicious files on corporate devices.
Initial Security Breach
The first suspected intrusion occurred in June when a Binance wallet development engineer downloaded a modified version of Homebrew, a widely used software installation tool, while searching online for an artificial intelligence coding application.
Binance said its security team identified unusual activity and responded by replacing the affected computer and resetting compromised credentials.
Despite those measures, the attackers had reportedly obtained information about the engineer’s responsibilities and colleagues within the wallet infrastructure department, which helped them plan subsequent attacks.
Fake Job Interviews Used to Install Malware
The campaign intensified in September when hackers contacted another Binance software engineer through a legitimate recruitment platform.
Posing as employees of a fictitious company, they arranged what appeared to be a conventional hiring process. The initial interview involved a video conversation with an individual claiming to represent the company’s human resources department.
To strengthen the deception, the recruiter shared social media profiles featuring personal photographs and videos.
A second interview was conducted by someone presenting themselves as the company’s chief executive. During the final stages, the engineer was instructed to download and complete a coding assessment using a work computer.
The downloaded files contained malicious code that installed software capable of avoiding security detection and communicating with an external server controlled by the attackers.
The technique allowed the hackers to turn a routine professional interaction into an entry point for accessing Binance’s corporate network.
Attackers Expand Access to Wallet Systems
After compromising the engineer’s computer, the attackers reportedly used information about Binance’s internal operations to identify additional targets.
On October 20, they exploited the compromised device and existing system access to take control of computers belonging to two other engineers involved in wallet infrastructure operations.
This expanded their access to sensitive credentials and permissions associated with the exchange’s digital asset management systems.
The attack reached its final stage on October 29, when the hackers allegedly used stolen credentials to deploy a container running a malicious script.
According to Binance, the script initiated unauthorised cryptocurrency transfers by exploiting weaknesses in the transaction approval process, bypassing the exchange’s standard withdrawal procedures.
Binance Reports $2.85 Billion Frozen or Intercepted
Binance said approximately $6.34 billion in digital assets was involved in the breach.
Of that amount, roughly $2.85 billion was subsequently frozen or intercepted through coordinated efforts involving the exchange and other cryptocurrency industry participants.
The company also reported that it had restored 98% of the affected assets using its own financial resources, maintaining that customers would not suffer losses as a result of the incident.
Binance said the US Federal Bureau of Investigation had attributed the attack to North Korean hackers. North Korea has denied involvement.
Exchange Strengthens Security Following Breach
Following the incident, Binance said it replaced compromised employee devices, revoked exposed credentials and rebuilt affected systems.
Additional measures included tighter access restrictions and enhanced security controls across its wallet infrastructure to reduce the risk of similar attacks.
The case highlights the growing threat posed by sophisticated social engineering campaigns targeting cryptocurrency businesses.
Rather than attempting to defeat technical safeguards directly, the attackers allegedly exploited professional relationships, recruitment practices and employee trust to penetrate critical financial systems.
The incident also raises broader concerns about the security of digital asset platforms, particularly where access to sensitive infrastructure depends on employees who may be targeted through increasingly convincing cyber deception.
