Key Takeaways
- • Binance disclosed on Tuesday that North Korean hackers used social engineering and malicious software to execute a $6.3 billion heist, described as the largest in crypto history.
- • Attackers posed as recruiters on LinkedIn, arranging fake job interviews to persuade a Binance software engineer to download a malicious "assignment" that gave them access to company systems.
- • A second engineer was lured by an internet ad offering a tampered version of the Homebrew software package, which provided the hackers with information about wallet roles and personnel.
- • Approximately $2.5 billion of the stolen funds was recovered after Tether and Circle froze stolen stablecoins; Binance says it has replenished 98% of the stolen coins from reserves and other sources.
- • Binance reported detecting and preventing 57 North Korea-related hacking attempts in 2026 and said it had flagged earlier LinkedIn targeting of its staff.
Summary
Binance on Tuesday disclosed that North Korean hackers used a combination of social engineering and malicious software to carry out last week's $6.3 billion heist, the largest theft in crypto history, according to company executives who spoke to reporters. The attackers targeted a Binance engineer on LinkedIn, posing as a Project Director, and arranged a first-round interview with an HR representative followed by a second-round interview with an individual claiming to be the CEO of a fictitious company. The sequence ultimately persuaded the employee to download an "assignment" that enabled intrusion into the company's systems.
Binance's report describes a monthslong campaign that also included a separate ad-based operation. A second engineer clicked on an internet advertisement promoting a tampered version of Homebrew, a popular software package, rather than downloading it through company channels. Binance said it detected the fake download and removed it from the employee's machine, but not before the hackers obtained critical information about that engineer's role and about others who managed the company's wallets. The combination of the fake LinkedIn outreach and that intelligence allowed the hackers to take control of a series of Binance wallets and drain them.
While early speculation centered on artificial intelligence, Binance's account indicates the intrusion relied primarily on conventional phishing tactics. AI did play a secondary role: after gaining control of the engineer's laptop, the attacker used Binance's internal AI tools to compromise accounts belonging to a Wallet DevOps Engineer and a Wallet Software Engineer, and discovered a container deployment permission token on one of those machines.
Binance said it had flagged earlier efforts to target its employees on LinkedIn and that it detected and prevented 57 North Korea-related hacking attempts in 2026. A company spokesperson said employees in non-public-facing roles are not permitted to maintain LinkedIn profiles, but declined to say whether the engineer had violated that policy or whether either engineer would be terminated. The company has disclosed that around $6.3 billion was stolen over several hours on Thursday, and that approximately $2.5 billion was recovered after Tether and Circle moved to freeze stolen stablecoins. Binance halted withdrawals for about 48 hours before re-enabling them on Saturday, says all customer funds are safe, and is in the process of acquiring the remaining 2%, consisting of lesser-used currencies, of the replenished holdings. In a statement, the company said: "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
Binance's report describes a monthslong campaign that also included a separate ad-based operation. A second engineer clicked on an internet advertisement promoting a tampered version of Homebrew, a popular software package, rather than downloading it through company channels. Binance said it detected the fake download and removed it from the employee's machine, but not before the hackers obtained critical information about that engineer's role and about others who managed the company's wallets. The combination of the fake LinkedIn outreach and that intelligence allowed the hackers to take control of a series of Binance wallets and drain them.
While early speculation centered on artificial intelligence, Binance's account indicates the intrusion relied primarily on conventional phishing tactics. AI did play a secondary role: after gaining control of the engineer's laptop, the attacker used Binance's internal AI tools to compromise accounts belonging to a Wallet DevOps Engineer and a Wallet Software Engineer, and discovered a container deployment permission token on one of those machines.
Binance said it had flagged earlier efforts to target its employees on LinkedIn and that it detected and prevented 57 North Korea-related hacking attempts in 2026. A company spokesperson said employees in non-public-facing roles are not permitted to maintain LinkedIn profiles, but declined to say whether the engineer had violated that policy or whether either engineer would be terminated. The company has disclosed that around $6.3 billion was stolen over several hours on Thursday, and that approximately $2.5 billion was recovered after Tether and Circle moved to freeze stolen stablecoins. Binance halted withdrawals for about 48 hours before re-enabling them on Saturday, says all customer funds are safe, and is in the process of acquiring the remaining 2%, consisting of lesser-used currencies, of the replenished holdings. In a statement, the company said: "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.