Binance on Tuesday disclosed that North Korean hackers used a mix of social engineering and malicious software to pull off last week's $6.3 billion heist, the biggest in crypto history, according to Fortune.
The disclosure provides the first detailed account of how attackers infiltrated one of the world's largest crypto exchanges, tracing the breach to a fake recruitment scheme and a tampered software download rather than a direct technical exploit.
Fake job interviews opened the door
Speaking to reporters, company executives said the hackers targeted a Binance engineer on LinkedIn and arranged a series of fake job interviews to persuade the employee to download an "assignment" that gave them access to company systems, Fortune reported.
In a related report, Binance explained that Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. The engineer's profile on the platform referenced his experience at Binance, according to the company's account.
The purported Project Director arranged a first-round interview with an HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company, the report stated.
A Binance spokesperson told Fortune that employees with non-public-facing roles are not allowed to maintain LinkedIn profiles. The spokesperson declined to say whether the engineer had violated that policy or whether either of the engineers involved would be terminated.
A second engineer and a tampered download
The company's report described a monthslong scheme that went beyond the fake LinkedIn recruitment. A separate ad campaign tricked another engineer into downloading a malicious version of Homebrew, a popular software package, Fortune reported.
According to Binance, that engineer did not download the Homebrew software through the company's regular channels but instead clicked on an internet ad promoting a tampered version. Binance said it detected the fake download and removed it from the employee's machine, but not before the hackers discovered critical information about the engineer's role and about others who managed the company's wallets.
It was the combination of the two exploits, the fake LinkedIn outreach and the knowledge gleaned from the tampered Homebrew download, that allowed the North Korean hackers to take over a series of Binance wallets and drain them of funds, according to the report.
Internal AI tools turned against Binance
While many initially speculated that the hackers had used AI to break into Binance, the company's account shows the attackers relied primarily on conventional phishing tactics. Binance said, however, that AI did play a role once the attackers were inside.
After gaining control of the engineer's laptop, the hackers used Binance's own internal AI tools to compromise other accounts, according to the report. The attacker leveraged the compromised computer of Engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C, the report stated.
The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer, the Binance report added, according to Fortune.
Recovery efforts and frozen stablecoins
The attack unfolded over several hours on Thursday. Binance has disclosed that the hackers stole around $6.3 billion, but said it recovered roughly $2.5 billion of that after Tether and Circle moved to freeze stolen stablecoins, Fortune reported.
In response to the hack, Binance shut down withdrawals for around 48 hours before re-enabling them on Saturday. The company has repeatedly stated that all customer funds are safe and that it has replenished 98% of the stolen coins from reserve funds and other sources.
Binance said it is in the process of acquiring the remaining 2%, which consist of lesser-used currencies.
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in a statement.
A broader North Korea campaign
North Korean hackers posing as recruiters have become a widespread problem across the corporate sector more broadly, Fortune reported.
Binance said it had flagged earlier efforts by hackers to target its employees on LinkedIn and that, in 2026, it had detected and prevented 57 North Korea-related hacking attempts before last week's breach succeeded.
Conclusion
Binance's account attributes the largest theft in crypto history to a patient social engineering campaign: a fake job recruitment on LinkedIn, a malicious Homebrew download spread through an internet ad, and the use of the company's own internal AI tools to reach wallet systems. The exchange says customer funds are safe, withdrawals have resumed, and 98% of stolen coins have been replenished, with the remaining 2% of lesser-used currencies still being acquired.
Frequently Asked Questions
How did North Korean hackers steal $6.3 billion from Binance?
According to Binance's report, hackers ran a fake job recruitment scheme on LinkedIn to get one engineer to download a malicious assignment, and separately tricked another engineer into installing a tampered version of Homebrew through an internet ad. Combining access from both exploits, they took over a series of Binance wallets and drained the funds.
What role did AI play in the Binance hack?
Binance said the attackers relied primarily on conventional phishing rather than AI to break in. Once inside, however, they used Binance's own internal AI tools from a compromised laptop to take control of two additional engineers' accounts, including one holding a container deployment permission token.
How much of the $6.3 billion did Binance recover?
Binance said it recovered around $2.5 billion after Tether and Circle moved to freeze stolen stablecoins. The company says it has replenished 98% of the stolen coins from reserve funds and other sources and is acquiring the remaining 2%, which consist of lesser-used currencies.
Are Binance customer funds safe after the hack?
Binance has repeatedly stated that all customer funds are safe. The exchange shut down withdrawals for around 48 hours after the attack and re-enabled them on Saturday, and says it has replenished 98% of the stolen coins from reserves and other sources.
How many North Korea-related hacking attempts has Binance detected in 2026?
Binance said it detected and prevented 57 North Korea-related hacking attempts in 2026 before last week's breach. The company also said it had flagged earlier efforts by hackers to target its employees on LinkedIn, a tactic Fortune described as a widespread problem across the corporate sector.
Sources
Read Also
Hi, I’m Ahmed Falah. I work at the intersection of technology, finance, and human well-being, exploring how emerging digital systems can create sustainable and impactful growth across businesses and society.
As a senior author at Coinography, I write deeply researched content on blockchain ecosystems, tokenomics, decentralized finance, on-chain analysis, and the societal implications of Web3. My approach blends technical clarity with purpose-driven thinking, helping readers understand complex crypto concepts in a meaningful and accessible way.
Vision & Focus
Throughout my career, I have worked closely with hedge funds, enterprises, and high-net-worth investors, helping them navigate digital transformation and develop strategies rooted in data, transparency, and sustainable growth. I see technology not merely as a financial tool but as a foundation for creating healthier, more resilient organizations.
My writing focuses on a wide range of themes, including blockchain and decentralized financial models, token utility and ecosystem design, AI and blockchain convergence, the evolution of digital market infrastructure, purpose-driven and wellness-aligned leadership, and the future of work, finance, and organizational well-being.
I am deeply committed to building systems that empower individuals and support ethical innovation. My goal is to connect technology with human values and contribute to a future where digital ecosystems uplift people, communities, and businesses in meaningful and sustainable ways.
Professional Links
Website: https://coinography.com LinkedIn: https://ae.linkedin.com/in/ahmedfalah
Let’s Connect
If you’re interested in the future of blockchain, digital transformation, decentralized systems, or well-being-focused leadership, feel free to connect with me.
