Binance Reveals Multistage Attack Behind 6.34 Billion Dollar Crypto Heist

Binance has disclosed how hackers infiltrated its wallet infrastructure through fake recruitment interviews, malicious software and compromised internal artificial intelligence tools, resulting in the theft of $6.34 billion in cryptocurrency during an October 29 attack. The exchange said the operation developed over several months and involved multiple employee devices rather than a single security failure.

Binance co-CEO Richard Teng told CNBC on November 3 that the company had replenished 98% of the affected assets. The exchange continues purchasing the remaining assets, particularly those with lower liquidity.

Teng described the operation as a prolonged infiltration involving multiple stages and employees.

"The attackers spent months building their way in," said Richard Teng, Binance co-CEO.

He explained that the initial compromise began in June, when attackers distributed a counterfeit developer tool to an engineer. The campaign escalated in September through fraudulent recruitment activities targeting another member of the engineering team.

"In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that. In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security ... from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction," Teng said.

According to Binance's security report published Tuesday, the June incident involved a tampered Homebrew installation that an engineer downloaded while searching for a popular AI coding tool. Although the company detected suspicious activity, replaced the employee's device and rotated credentials, the attackers had already exposed the employee's role and connections within the wallet infrastructure team.

"role and his related colleagues on our wallet infrastructure team was exposed to the hacker," Binance stated in its security report.

The attackers subsequently compromised additional devices. On October 20, they used a laptop affected by the fake interview operation to infiltrate two other employees' computers. Stolen credentials were later used to initiate unauthorized cryptocurrency transfers.

Binance also disclosed that the attackers employed mechanisms designed to eliminate investigative traces and destroy malicious tools.

"We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said.

The company has rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices, deactivated exposed credentials and tokens, and expanded security checks across employee devices.

Teng also addressed the investigation into the attackers' identities and recovery efforts.

"We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front," Teng said.

Binance has temporarily restricted certain withdrawals, committed to covering all customer losses and used its Secure Asset Fund for Users to protect affected accounts. Tether and Circle, alongside other industry participants, helped freeze approximately $3 billion in assets, while some stolen cryptocurrency continued moving through laundering channels.

According to Yahoo Finance, Binance had processed $4.649 billion in withdrawals and approximately $1.01 billion in deposits by late Sunday night Eastern Time. The exchange suspended withdrawals following the incident before restoring the service on Sunday.

Binance founder Changpeng Zhao, also known as CZ, said the company had restored normal platform operations and maintained customer fund protection.

"It's been a pretty hectic process," said Changpeng Zhao, Binance founder, in an interview with Yahoo Finance.

Zhao addressed the restoration of withdrawal services and the platform's operational status following the security incident.

"But the good thing is right now the withdrawals have been restored, the system's back to normal. People are free to use the platform without any issues now. And then all user funds are covered," Zhao said.

He also emphasized that customers had not experienced financial losses from the incident.

"The users did not suffer any loss," Zhao said.