From a Fake Recruiter to a US$6.3B Theft, Here’s How the Binance Crypto Hack Happened

Over the past few days, there has been a lot to unpack about the Binance hack, the largest crypto theft on record at about US$6.3 billion.

The most revealing update came from Binance itself. Its initial findings describe a campaign that ran for about five months, built on fake recruitment interviews, a tampered software download, a compromised internal AI tool, and hijacked work computers.

How did the Binance crypto hack happen?

How the Binance Crypto Hack Scaled Over 5 Months

According to Binance, the attack was a multi-stage campaign carried out over about five months. The attackers used fake recruitment interviews, malicious software downloads, a compromised internal AI tool, hijacked laptops, and an advanced way of getting transactions authorised.

The attack started with social engineering and employment fraud.

Step 1: A Tampered Download Exposes the Wallet Team

The first opening came from a supply chain attack. An engineer on Binance’s Wallet DevOps team, referred to as Engineer A, wanted to install a popular AI coding tool.

He searched for it on a search engine and ended up downloading a tampered installation of Homebrew, a tool used for installing software on Mac computers.

Binance’s security team spotted the anomaly. It replaced Engineer A’s device and rotated all related credentials as a proactive security action.

But the damage was already done as the attackers gained exposure into Engineer A’s role and his colleagues on Binance’s wallet infrastructure team.

Step 2: A Fake Recruiter Makes Contact

In September, the attackers went after a second employee, Software Engineer B. Someone posing as a “Project Director” contacted him through a legitimate job-hunting platform, where his profile mentioned his experience at Binance.

The fake Project Director set up a two-round interview process. The first round was with an “HR representative” and the second with someone claiming to be the CEO of a company that didn’t exist.

Step 3: Building Trust in the First Interview

The “HR representative” interviewed Engineer B over a live video. To make the persona believable, the interviewer shared a social media account full of personal photos and videos in a bid to gain trust.

Step 4: The Malicious “Assignment”

The second interview happened on a popular social chat app. Near the end, Engineer B was told to download an “assignment” onto his work computer. This included a malicious code repository , and that code ran during setup, kicking off a series of unauthorised activities.

Step 5: The Malware Hides in Plain Sight

The malware used sophisticated obfuscation and evasion techniques to avoid detection.

Its core tactic was swapping a genuine development tool component for a malicious copy, allowing it to run commands and set up contact with an external server controlled by the attacker.

It was a zero-day threat, meaning nobody had seen it before, so Binance’s endpoint security tools didn’t detect it at the time.

The attackers also covered their tracks and removed traces of the compromise, which made the attack harder to spot and to investigate afterwards.

Step 6: An Internal AI Tool Becomes a Springboard

Leveraging Engineer B’s compromised computer, the attackers used an internal Binance AI tool to take control of two more people: Wallet DevOps Engineer A, the same engineer exposed in June, and another wallet team member, Software Engineer C.

The attackers soon found that Engineer A’s computer held a container deployment permission token.

Step 7: The Strike on Wallet Signing Operations

On 29 October, between 17:15 and 19:56, the attackers logged into Engineer C’s computer. Using credentials stolen from Engineer A, they deployed a container and ran a malicious script that launched the attack.

According to our recent analysis, the latest crypto breach at the company is four times the previous record from Bybit in 2025.

Binance Details Its Recovery, Co-Founders Weigh In

In the days since the aftermath of the US$6.3 billion breach, the co-founders as well as the co-CEO of Binance have spoken about the incident.

Co-CEO Richard Teng, on stage at the Hong Kong Fintech Week 2026, gave the company’s account of the work underway to manage the situation.

Richard said that Binance takes “full responsibility and accountability”, and that the shortfall is being covered by its Secure Asset Fund for Users (SAFU), an emergency reserve fund the company has to protect users in extreme cases.

“We tripped up. It’s a very painful lesson. We went on very quickly to rebuild the entire withdrawal function to make sure it’s safe, and then we started allowing users to withdraw from Sunday.”

SAFU functions as a “last-resort safety net”, and is held and managed by Nest Clearing and Custody Limited, which Binance shares is regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority.

Binance says the fund is worth about US$1 billion and is held entirely in Bitcoin.

Richard also said 95% of the stolen tokens have already been replenished, with the remaining 5% being sourced through OTC providers to avoid moving the market. Withdrawals were rebuilt and reopened on Sunday, and he said hourly flows have since returned to normal.

Yi He, a Co-Founder to Binance, shared on X that throughout the year, the security team at Binance detected and prevented 57 suspected North Korea-linked cyber threat cases.

“The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware. We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.”

Changpeng “CZ” Zhao, also a Co-Founder of Binance, dived in too in an interview with Yahoo Finance, sharing,

“As a shareholder, I voiced my opinion pretty quickly that all users will be covered, and the company followed through on that.”

When Yahoo Finance’s Executive Editor Brian Sozzi asked CZ if he had ever imagined that Binance could suffer a hack like this, CZ added,

“There’s no 100% security. When you run a platform, especially a crypto platform, the possibility is always there. Did I think it was going to this big of a magnitude? Probably not.”

CZ tied the size of the loss to Binance’s growth. Noting that the platform has grown over the last few years, he said the amount Binance holds in its hot wallet needs to be “recalibrated”, in his view.

He was also clear in highlighting that the risk is not Binance’s alone, but for the overall financial industry.

“For every crypto platform, every wallet service, every financial institution that you use, this is a possibility. Especially now with AI improving so quickly, I think we’re going to see a lot more of this.”

Featured image edited by Fintech News Singapore based on an image by pvproductions on Magnific