Binance has now set out, in its own investigation findings, how hackers managed to steal $6.34 billion in cryptocurrency in an attack that unfolded over roughly four hours on October 29. The world’s largest cryptocurrency exchange by daily trading volume says the theft, believed to be the biggest crypto heist on record, was the end point of a campaign that began months earlier, built patiently on deception, infected software and, in the end, the misuse of an internal artificial intelligence tool.
The story, as Binance tells it, starts in June. The attackers persuaded one of the exchange’s engineers to download a compromised version of Homebrew, a widely used software package manager that developers rely on to install tools on their machines. Binance’s cybersecurity team spotted the malware and removed it, but by then the intruders had already gathered information about the employee and his colleagues. That early foothold mattered, because it gave the attackers the material they needed to come back with a far more convincing approach.
The second approach came in September, and it was a study in social engineering. The attackers contacted a different Binance engineer through a legitimate recruitment platform and offered an interview for a job at a company that did not exist. To look credible, they shared photographs and videos on social media and built up trust over time. Then, as part of the supposed interview process, they asked the engineer to download a technical assignment. The assignment carried malware designed to hide its own activity and slip past detection, and it replaced a genuine development-tool component with a malicious version. Binance says that infection gave the attackers a crucial connection into its internal systems, the bridge they had been working towards since the summer.
On October 20, the attackers used that access, together with an internal AI tool, to compromise software used by two more engineers. Nine days later they activated the malicious code and launched the theft itself. The sequence is a reminder of how modern cyberattacks rarely arrive as a single dramatic break-in. Instead, they advance in stages, each one small enough to pass unnoticed, each one opening the door a little wider, until the final step can be taken quickly. In this case the final step took only about four hours, but the preparation behind it stretched across five months.
The scale of what was taken explains why the case has drawn so much attention. Binance says it has already replaced 98 percent of the affected assets using its own funds, while the remaining assets involve cryptocurrencies that are traded less frequently and are harder to buy back. Around $2.85 billion of the stolen funds has been frozen, which prevents the attackers from spending or converting those assets. News of the breach sent most major cryptocurrencies sharply lower, a reaction that underlines how much confidence in the whole market rests on the security of its largest trading venue.
Attribution has added a political edge to the affair. The United States Federal Bureau of Investigation has attributed the attack to hackers affiliated with North Korea, an accusation Pyongyang has rejected, with Kim Jong Un’s sister dismissing it as absurd rhetoric. The exchange itself has not made attribution the centre of its account; its findings concentrate on method rather than motive. A compromised package manager, a fake job interview and a poisoned development tool are not exotic techniques. They are everyday risks for any technology company, and they worked here against one of the best-resourced firms in crypto.
For exchanges, wallet providers and ordinary users, the episode points to several uncomfortable truths. First, recruitment has become a front line in cyberattacks, and a plausible interview process can be as dangerous as a phishing email. Second, the software supply chain, the everyday tools developers download without thinking, can carry an attack deep inside a company before anyone notices. Third, internal AI tools, powerful precisely because they can reach across systems, need the same strict controls as any other privileged access. Binance’s account shows all three weaknesses being exploited in a single campaign, which is why the case is likely to be studied far beyond the crypto world.
What happens next will be watched on several fronts. Investigators and the exchange will keep tracing the frozen and missing funds, a process that can take months as stolen crypto moves through mixers, exchanges and over-the-counter desks. The less frequently traded assets that Binance has not yet replaced will test how quickly even a large exchange can make its users whole. And regulators, already uneasy about the size and speed of crypto markets, will ask whether the security standards of the biggest platforms match the scale of the money they hold. Binance has moved to reassure its customers by covering almost all of the loss itself, but the deeper question, how an attack prepared over five months could succeed at all, will not be answered by reimbursement alone.
