A coding assignment from a prospective employer looked like an ordinary part of a job interview. In reality, it was one step in a months-long cyberattack that ended with $6.3 billion stolen from Binance — and it is raising fresh questions about how crypto exchanges defend against threats aimed at their own employees.

According to a postmortem released by Binance on Tuesday, the theft was part of a coordinated campaign that exploited both human vulnerabilities and internal security systems. The exchange's findings trace how hackers gradually worked their way into the company's wallet infrastructure ahead of the Oct. 29 theft.

How hackers infiltrated Binance

The campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool, according to Binance's security report. Although the exchange detected the malware and replaced the affected device, the attackers had already gathered information about Binance's wallet team. The episode shows how an infection can still matter after it is caught: swapping the device removed the malware, but not the reconnaissance the attackers had already completed.

In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment. The malware compromised the engineer's work computer and evaded the exchange's security protections.

On Oct. 20, the attackers used the compromised machine and an internal AI tool to gain access to the systems of two additional engineers, obtaining deployment credentials that allowed them to install malicious software inside Binance's wallet infrastructure on Oct. 29.

The intruders then reached the exchange's internal wallet-signing service, which authorizes cryptocurrency transactions, enabling them to move funds outside the normal withdrawal process. Access at that layer meant the funds could move with the exchange's usual withdrawal controls out of the loop — the same dynamic that later allowed transfers to continue even after Binance suspended withdrawals.

"This wasn't one mistake or one breach — it was a months-long campaign," Binance co-CEO Richard Teng said in a Tuesday post on X.

Source: Richard Teng on X

EIP-7702 exploited to keep transfers moving

Binance said the attackers also exploited Ethereum's EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts. That let unauthorized transfers continue even after the exchange suspended withdrawals. Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, complicated efforts to revoke those permissions. Together, the two designs meant stopping the unauthorized transfers required unwinding permissions across the wallet system rather than cutting off a single point of control.

The breach affected approximately $6.3 billion in digital assets, with Binance reporting that $2.85 billion had been frozen or intercepted, according to its latest accounting. The exchange said it would absorb the losses rather than pass them on to customers and had replenished 98% of the affected token assets as of Oct. 31. Those figures represent the exchange's latest snapshot rather than a final resolution, so subsequent updates on the assets beyond the $2.85 billion frozen or intercepted — and on whether replenishment moves past 98% — will shape how the breach's final accounting reads.

The attack — the largest cryptocurrency hack in history — has been attributed to North Korean hackers by the Federal Bureau of Investigation (FBI). On Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied her country's involvement, saying the FBI's attribution was politically motivated and intended to damage North Korea's international standing. The statements leave the two accounts publicly at odds, with the FBI's attribution and Pyongyang's denial standing unreconciled.

Binance reports 57 cyber threats blocked this year

Separately, Binance co-founder Yi He said Tuesday that the exchange's security team had detected and prevented 57 suspected North Korea-linked cyber threats in 2026, including fraudulent job interviews, malicious software packages and social engineering attempts aimed at stealing credentials or installing malware. The 2026 tally indicates the methods at the center of the breach — fake recruiter approaches, tampered packages and credential-harvesting attempts — were recurring patterns in Binance's threat data rather than one-off events.

"We intercepted many of them, but the cost of failing to stop even one was severe — and this should never have happened," she said.

This article was originally reported by Cointelegraph.