The hackers who stole $6.3 billion from the Binance crypto exchange last week first infected the computers of two of its engineers through a fake interview and malware hidden in an ad, according to the exchange’s first investigation report, as recounted by Reuters. Preparation for the attack, which is considered a potential largest theft in financial history, began back in June.
In June, a member of the crypto wallet development team downloaded a program from the internet that had been modified by attackers; according to a Reuters source, a fake copy of it was placed in targeted search ads so it would appear above the real one. The exchange noticed the infection and changed credentials, but the hackers had already learned which employees worked with wallets.
In September, another engineer looking for a new job downloaded malicious code after an interview and spoke by video with the “CEO” of a nonexistent company. On October 20, the attackers used the infected computer and Binance’s internal AI tool to gain control of the systems of two wallet developers.
On October 29, they launched a malicious script and, over four minutes, withdrew 233.46 million XRP coins from five internet-connected exchange wallets, and then bitcoin and other cryptocurrencies. Binance froze about $2.85 billion, but the hackers’ last transfer went through almost four hours after the attack began, and that evening the exchange suspended all transactions.
The FBI attributed the theft to a North Korean hacker group, while North Korea denies it. Experts at TRM Labs and Pangolin Intelligence linked the attack to the TraderTraitor group; according to Binance, only in 2026 it prevented 57 suspected cyberattacks linked to North Korea and promised to reimburse losses to all affected customers.
Binance’s report notes that the previous record was $1.5 billion stolen from the Bybit exchange in 2025; at that time, the FBI also accused TraderTraitor of the theft.
Sources
