The $6.34 billion theft from Binance began with a staged job interview and ran for five months before a single coin moved, according to the exchange's first public account of the Oct. 29 attack, released Tuesday.

An initial incident report from Binance, published on X and released alongside a media briefing by co-CEO Richard Teng and chief security officer Jimmy Su, describes a campaign that combined a poisoned software download, a staged recruitment process, malware that evaded endpoint detection and an internal AI tool that the attackers turned against the company's own wallet engineers.

Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance being bought on the open market. The figure, if fully confirmed, would make it the largest theft yet recorded in the cryptocurrency industry, surpassing the roughly $1.5 billion taken from Bybit in February 2025 — an attack investigators also linked to North Korean actors.

"This wasn't one mistake or one breach — it was a months-long campaign," Teng wrote on X. "We're publishing the full report because the lessons go far beyond Binance."

The FBI has attributed the attack to North Korea, a finding Binance's report cites while stopping short of its own attribution. Pyongyang rejected the claim on Monday, with Kim Yo Jong, sister of leader Kim Jong Un, calling it a "grave political provocation" through state media. United Nations panels and blockchain-analysis firms have for years tied North Korean hacking units to billions of dollars in cryptocurrency stolen from exchanges and protocols worldwide.

Five Months of Preparation

According to Binance, the attackers' first foothold came in June, when a wallet DevOps engineer searching for a popular AI coding tool downloaded a tampered Homebrew installer. The security team caught the anomaly, replaced the device and rotated credentials, but the episode exposed the engineer's role and the names of colleagues on the wallet infrastructure team.

In September, a second engineer was approached on a legitimate job platform by someone posing as a project director. A video interview with a purported HR representative followed, during which the interviewer shared a personal social media account to build trust. A second interview with a supposed CEO ended with an "assignment": a code repository the engineer was told to install on his work machine.

The repository replaced a legitimate pyenv component with a malicious version and opened a channel to an attacker-controlled server. Binance said the zero-day malware was not flagged by its endpoint tools at the time.

On Oct. 20, the attackers used that machine and an internal AI tool to reach two more wallet engineers, one of whom held a container deployment token. On Oct. 29, between 17:15 and 19:56 UTC, they logged into a third engineer's computer, deployed a container with the stolen credentials and launched the drain. Binance said it blocked 57 other suspected North Korea-linked attempts this year using similar lures. U.S. authorities have warned for years about such fake-recruiter campaigns aimed at implanting malware inside technology and crypto companies through their own employees.

Four Hours to Contain

The money moved quickly. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address. Wallets on Solana and Optimism followed with about 970,500 SOL and 44.2 million OP, and a Binance hot wallet then sent 18,270 BTC.

The attacker also used the compromised signing service to invoke Ethereum's EIP-7702, a standard introduced in the network's 2025 Pectra upgrade that lets an account delegate execution rights to a smart contract without exposing its key, and gave an attacker-controlled contract partial control of a Binance hot wallet.

Suspending withdrawals did not stop that last channel. The attackers had submitted 50 signing transactions to establish on-chain delegations that operated outside Binance's withdrawal infrastructure. Because the wallet used multi-party computation, no single key existed to revoke them, and the team had to build a procedure on the spot. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC, and Binance cleared the delegation at 00:10 UTC on Oct. 30.

The report acknowledges the gap. "These challenges extended the time required to fully contain the unauthorized asset movements," it says, adding that the company is reviewing its signing policy coverage and hot wallet controls.

Outflows, Then Signs of Stabilization

Customers withdrew $10.97 billion in the 46 hours after withdrawals reopened Sunday, with net outflows of $5.28 billion, according to data Teng shared Tuesday. By 03:00 UTC, hourly deposits exceeded withdrawals — a shift Teng called a sign of stabilization. On Tuesday, Binance reopened withdrawals for dozens more assets across nine networks.

The breach has also become a talking point in Washington. CFTC Chairman Michael Selig said the hack "proves our exact point" about the need for a federal registration path for offshore exchanges, and on Tuesday the agency cleared equity perpetual futures for U.S.-regulated venues, extending the onshoring push it began with Kalshi's bitcoin perp in May.

Binance said it has rebuilt the wallet system and the internal AI tool in new environments, replaced affected devices, revoked the engineers' credentials and expanded behavioral anomaly detection. It is commissioning an independent review, raising spending on endpoint and developer-environment security and planning a research fund on AI security with outside firms. How quickly the remaining stolen tokens are bought back, whether the frozen assets can be recovered and what the independent review concludes are the immediate items to watch. Some technical details, the report says, will stay private.

This article originally appeared on Bitcoin Magazine and was written by Micah Zimmerman.