Binance disclosed that a sophisticated group of hackers targeted the exchange for a total of $6.34 billion in cryptocurrency, marking the largest sum ever pursued in a digital‑asset theft. According to the company, the attackers began their campaign no later than June and continued through to the previous Thursday, when they finally compromised an engineer’s laptop and moved assets from multiple wallets.
Scope of the theft and Binance’s response
The FBI and cybersecurity firm TRM Security have both linked the operation to North Korean actors, though Binance’s public statement does not name any specific agency. Of the $6.34 billion originally targeted, the exchange says it has frozen or intercepted $2.85 billion, effectively preventing that portion from leaving its control. Binance also confirmed that it has set aside the necessary funds to cover the loss, directing users to a Proof of Reserves page that demonstrates the firm’s remaining liquidity.
In a report on its internal investigation, Binance described the incident as a “sophisticated, multi‑stage campaign” rather than a single breach or a simple phishing attack. The company emphasized that the threat actors demonstrated a high level of resourcefulness, employing a blend of social engineering, custom malware, and advanced transaction‑authorisation techniques to evade detection.
Details of the attack methodology
According to Binance, the attackers leveraged several distinct tactics. One early vector involved fake recruitment interviews designed to gain the trust of employees and extract credentials. The group also distributed malicious software downloads, notably a tampered version of the Homebrew package manager, which an engineer downloaded in June. The compromised software allowed the perpetrators to infiltrate the engineer’s laptop and gather information about his role and the roles of colleagues on the wallet infrastructure team.
Further tactics included the compromise of internal artificial‑intelligence tooling, which the hackers used to mask their activities and manipulate transaction‑authorisation processes. Endpoint compromise—direct control over the engineer’s computer—enabled the actors to issue withdrawals from multiple Binance wallets after they had mapped the organization’s internal architecture.
Binance’s security team first detected the tampered Homebrew incident after it was reported in May, but the full scope of the compromise was only uncovered once the malware operators had already harvested role‑specific data. The company’s statement noted that the attackers combined “social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction‑authorisation method” to execute the theft.
While the investigation remains ongoing, Binance’s public communication underscores that the breach was not the result of a lone phishing email but rather a coordinated, multi‑layered operation that unfolded over several months. The exchange’s ability to freeze nearly half of the targeted funds and its commitment to covering the loss reflect a proactive stance aimed at preserving user confidence in the wake of the unprecedented crypto heist.
Norman Pearlstine is the Executive Editor and Co-Founder at News Raise. With over two decades of experience across financial journalism, corporate governance, and market analysis, Norman leads the editorial direction and ensures strict adherence to journalistic accuracy and ethics.
