Binance restores 98% of assets after hackers stole $6.3 billion via fake interviews

Binance co-CEO Richard Teng stated on Tuesday that hackers stole more than $6 billion in digital assets from the world's largest cryptocurrency exchange during a cyberattack on Oct. 29. The intruders utilized a combination of social engineering and technical vulnerabilities to bypass security measures. Teng confirmed that the exchange has now replenished 98% of the $6.34 billion in affected assets. The company is currently purchasing the remaining illiquid assets to fully cover customer losses.

Teng explained that the attackers did not rely on a single point of failure. Instead, they spent months establishing a foothold within the organization. In June, the team identified a tampered installation of a developer tool that an engineer had downloaded. The company replaced the device and rotated credentials but acknowledged that the engineer's role and colleagues on the wallet infrastructure team were exposed to the hackers.

In September, the attackers posed as recruiters and conducted a series of job interviews with another engineer. These interviews included a coding exercise containing hidden malware designed to evade detection. The malicious software allowed the intruders to move through internal AI tools and gain access to the system that authorized wallet transactions. Teng said this access led to the large-scale theft in October.

The FBI has linked the attack to North Korean hackers associated with the TraderTraitor group. While Teng did not formally attribute the breach to North Korea, he noted the agency's findings. Binance and industry partners, including Tether, Circle, and Ripple, have frozen approximately $3 billion in stolen assets. Some funds continue to move through laundered channels, and Coinbase blocked transfers to compromised wallets to assist in the recovery effort.

The exchange has rebuilt the affected wallet system and internal AI tool. It replaced compromised devices and decommissioned credentials and tokens linked to the affected engineers. Security scans across employee devices have been expanded. Teng said an independent expert is reviewing the company's actions. The team is working with law enforcement and industry partners to trace and freeze the remaining stolen funds.

Binance temporarily restricted certain withdrawals during the incident but pledged to cover all customer losses from its own reserves. The company maintains that it remains financially sound. The incident caused a sharp drop in market confidence, though investors are now monitoring the company's ability to restore trust in centralized exchanges.