By Sumayya
PARIS/DETROIT — Online thieves used a fake job interview and hidden computer code inside a search advertisement to break into the computers of two software builders at Binance. Then, they used a third worker’s computer to steal US$6.3 billion worth of digital currency in a record-breaking theft last week, the business shared on Tuesday.
In its very first report explaining how the thieves pulled off what might be the biggest money theft in history, Binance detailed a multi-step digital attack. The plan started back in June and led to a chain of broken security steps, finishing with the massive theft on Thursday.
Even while Binance raced to lock down its network and stop all cash-outs after spotting the attack late Thursday, the thieves kept taking digital money from the platform for nearly four hours after the very first theft began, Binance stated.
The FBI has pointed the blame at a hacking group from North Korea, though North Korea has denied this claim. Binance has stated that it is giving back all the money to customers whose funds were stolen.
This attack has raised a lot of questions about how thieves managed to break into the world’s biggest digital currency trading platform, especially after years of attacks linked to North Korea that have grown bigger and happened more often. It also brings up fresh doubts about how safe digital assets are from online crime.
Computer safety experts and state workers have warned for years about North Korean and other online thieves using fake job interviews to target workers at important firms, explained Michael Barnhart, a researcher with the computer safety business DTEX. Setting up fake job interviews is a very common trick used by digital thieves.
Binance stated that it had spotted and stopped 57 suspected online threats linked to North Korea during the year 2026. This shows that Binance is simply facing a non-stop flood of attacks, Barnhart explained.
“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance expressed inside its official report.
Left exposed
Binance explained that the attack started in June when a worker on its digital wallet development team downloaded a tool from the web that thieves had messed with. The business stated it found out about this later, swapped out the broken computer, and changed the login passwords, but the worker’s duties and the roles of others on the wallet team were already uncovered.
A person who knows about the event stated that the bad version of the tool had been hidden inside a search advertisement. This meant it showed up higher on search engines than the real, safe version.
Later in September, a second software builder who was looking for a new job downloaded a bad collection of computer code onto their machine. They did this after interviewing for what they believed was a real job role, which even included doing a video meeting with the boss of a fake business, the Binance report explained.
On October 20, the attacker utilized the broken computer along with an internal artificial intelligence tool to take management over the system of the wallet builder and a second wallet developer.
Nine days later, the attacker used the computer of the second wallet developer, along with the stolen login details of the first wallet builder, and started a bad computer script to launch the main attack.
Only a small count of builders at the firm have direct entry to the wallets that hold and trade digital currencies, the person who knows about the hack shared.
Crypto removed in minutes
The attack happened very fast on October 29, moving 233.46 million of the XRP cryptocurrency out of five of Binance’s internet-linked wallets into an address owned by the attacker in just four minutes. After that, the attackers took out other digital currencies, including bitcoin, the platform shared in its report.
Binance stated it got an internal warning about massive money moves and started looking into it. The firm moved to stop all cash-outs, lock down the affected digital coins, and remove the attackers’ illegal access. This allowed them to freeze about US$2.85 billion in assets, but stopping cash-outs alone was not enough to halt all illegal money movements.
The attackers utilized 50 electronic approval moves to control the account, while Binance stated it had to build brand-new methods to cancel those permissions, which slowed down their speed to react.
The final illegal money move happened at 2356 GMT, Binance stated, which was nearly four hours after the digital attack first started.
Binance explained that because of this hack, it is raising its spending on artificial intelligence tools to spot threats, and it is working to set up a safety research fund along with special projects alongside top AI firms.
