Binance Details $6.3 Billion Hack as US Regulators Check Bank Systems

Binance's account of the roughly $6.3 billion theft begins with employees' computers, not a direct assault on its cryptocurrency wallets. The exchange says attackers spent months preparing the breach through fake recruitment approaches, malicious software and abuse of an internal AI tool, according to The New York Times.

In September, an engineer received what appeared to be a job opportunity. During the supposed interview process, the engineer downloaded malware onto a work computer, The Register reported. That deception ultimately helped attackers compromise Binance's wallet infrastructure, according to BleepingComputer.

On October 29, Binance confirmed that hackers had stolen about $6.3 billion in digital assets, according to Публикации по подписке. The exchange later paused withdrawals for almost two days and said it would bear the financial cost, Japan Times reported.

On November 3, Binance published its account of the attack. The report described a campaign involving fake job interviews, an engineer's work computer and an internal AI tool, according to The New York Times. Reporting the following day, SecurityWeek said the company's initial investigation traced compromises across three engineers' computers.

The reported methods also included a malicious Homebrew download, according to Tom's Hardware. Binance said code downloaded during a purported interview contained malware that evaded its security tools, according to Technology.

The FBI attributed the attack to North Korea's TraderTraitor operation, Business Line reported on November 4. TechCrunch reported that researchers had warned for years about the persistent North Korean hacking tactics involved.

By November 5, the consequences had extended beyond the exchange. US regulators had checked in on bank systems following the hack, according to sources cited by Reuters. The supplied reporting does not establish that banks were breached.

Binance says roughly $2.85 billion of the stolen $6.34 billion has been frozen, preventing attackers from using it or converting it into another currency, according to The Hindu. Frozen assets are not necessarily funds already returned to the exchange.

Reports give different figures for Binance's financial response. CNBC reported on November 3 that Binance had replenished 98% of affected assets. Business Line reported the following day that the exchange had covered more than 100% of losses. The supplied coverage does not explain the different measures.

The theft total also varies slightly: The Hacker News gives $6.43 billion, while CNBC and The Hindu give $6.34 billion. Most headlines describe it as a roughly $6.3 billion theft.

The immediate questions are how much of the frozen cryptocurrency can be recovered and how Binance will document its coverage of the losses. Its first incident report is preliminary, according to SecurityWeek, leaving further findings about the compromised computers and internal AI tool pending.

The scope and outcome of the US regulatory checks also remain unclear in the supplied coverage. Reuters reports that regulators checked on bank systems, but provides no findings in the material available here.