Binance co-CEO Richard Teng disclosed details of the Oct. 29 cyberattack that stole $6.34 billion in assets from the exchange. The hackers spent months infiltrating the system using multiple entry points, not a single failure.
In June, attackers created a fake version of a developer tool and convinced a Binance engineer to install it. In September, the same group posed as recruiters and conducted job interviews with another engineer, using a coding exercise containing hidden malware designed to evade security protections. From there, the hackers accessed internal AI tools and compromised the system authorizing wallet transactions.
The FBI has linked the attack to North Korean hackers tied to the TraderTraitor group, though Teng did not make that attribution himself.
Binance has replenished 98% of the $6.34 billion in affected assets and continues purchasing more illiquid stolen assets. The exchange has temporarily restricted certain withdrawals and pledged to cover all customer losses using its own reserves.
Industry partners including Tether, Circle, and Ripple have frozen approximately $3 billion in stolen assets. Coinbase blocked transfers to compromised wallets and offered direct assistance to Binance.
Teng said Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, and decommissioned credentials tied to the affected engineers. The exchange is bringing in an independent expert to review its response and working with law enforcement and industry partners to trace and freeze remaining stolen funds.