Binance has disclosed how hackers carried out the theft of $6.3 billion in cryptocurrencies from its systems last week, saying the operation was set in motion months earlier and relied in part on a fabricated job interview, Spiegel reports. In a statement, the exchange described the intrusion as a sophisticated, multi-stage campaign and acknowledged that it should not have succeeded, apologising to users, partners and the wider industry for the disruption.
According to Binance, the trail leads back to June, when a member of its wallet development team downloaded tampered software. The company said it spotted a problem at that point and changed the employee's passwords, but the attackers had already learned his identity and those of several colleagues.
Why it matters
The disclosure puts a timeline and a method behind one of the largest losses ever suffered by a crypto platform, and it shifts attention from the moment of theft to the months of preparation that came before it. Binance is the biggest exchange in the market, so an intrusion of this size raises questions about how well even well-resourced firms can defend staff devices against patient, targeted deception. The case also adds detail to a wider pattern: investigators have repeatedly tied major crypto thefts to state-linked groups, and Binance says its security team has already flagged 57 suspected North Korea-related cyber threats in 2026.
A second download and a fictional employer
The decisive step came in September, per Binance's account. A second software developer loaded different malicious code onto his computer while taking part in a virtual conversation with the head of a company that did not exist — a meeting arranged as part of his search for a new job.
From there, the attackers worked through that machine and an AI tool to gain control of the IT systems used by the wallet developer and one of his colleagues, Spiegel reports. Using the colleague's computer and stolen credentials, they planted a harmful script that carried out the attack.
Binance did not say how the fake recruitment process was set up or how the AI tool was compromised, and it has not specified which wallets or assets were affected beyond the total figure.
Blame pointed at Pyongyang, and a denial
The FBI and private analysis firms have attributed the raid to hackers acting on behalf of North Korea's government. The country's leadership rejects the accusation, according to WELT and DIE ZEIT, which reported that Pyongyang dismissed the allegation of a billion-dollar robbery as absurd.
Binance's own statement does not name a perpetrator, but its reference to dozens of North Korea-linked threat cases this year shows how the company frames the risk. The exchange has also moved to soften the financial blow: it said customers had withdrawn $4.6 billion from the platform, and that roughly $1 billion has since flowed back. Spiegel separately reported that Binance is replacing 90 percent of the stolen funds.
The episode follows a period in which investors had been pulling away from the exchange, and the refund effort appears aimed at steadying confidence.
What to watch
Attention now turns to whether Binance publishes more technical detail on the compromised AI tool and the fake hiring process, and to how regulators and law enforcement respond to the North Korea allegation, which Pyongyang continues to deny.
