The attack reportedly involved social engineering tactics where hackers posed as recruiters on platforms like LinkedIn to conduct fake job interviews with engineers, eventually persuading one to download a malicious coding exercise. Additionally, a fraudulent advertisement for the 'Homebrew' software package was used to compromise another engineer's workstation. Once inside, the attackers reportedly exploited internal artificial intelligence tools to gain unauthorized access to the system responsible for authorizing wallet transactions. Binance co-CEO Richard Teng stated that the company has replenished 98% of the affected assets. Analysts and major outlets have attributed the breach to North Korean hackers, and South Korea's president has since called for a national 'cybersecurity czar' to address such threats.
According to the company, the operation began in June and involved a monthslong campaign of fake job interviews and social engineering. An engineer inadvertently downloaded malware that allowed attackers to infiltrate the company's network, exploit an internal AI tool, and access wallet signing services. Although billions were siphoned in a 20-minute window, Binance reported that roughly half of the targeted funds have been frozen or intercepted. The FBI has attributed the attack to North Korean cybercriminals, a claim Pyongyang has denied.
Cryptocurrency markets and exchange-traded funds (ETFs) have seen significant outflows following a major hack of the Binance exchange on October 29. The hack is being described by investigators as a five-month campaign involving sophisticated social engineering and malware. Amid the market downturn, BitMine Immersion founder Tom Lee described the lack of systemic failure as a 'constructive' sign, continuing to increase his firm's Ethereum holdings.
The incident resulted in a nearly three-day suspension of withdrawals. During this period, rival exchanges Bybit, Bitget, and OKX recorded significant increases in crypto deposit activity, though data does not definitively confirm if these inflows were direct migrations from Binance customers. Binance co-CEO Richard Teng stated the exchange remains in 'very strong financial health' and is preparing a post-mortem report. Preliminary findings suggest the breach was executed by North Korea-linked actors who compromised internal systems over several months after initiating contact through a fake j
