Binance on Tuesday disclosed that North Korean hackers used a mix of social engineering and malicious software to pull off last week’s $6.3 billion heist, the biggest in crypto history. Speaking to reporters, company executives revealed that the hackers targeted a Binance engineer on LinkedIn and arranged a series of fake job interviews in order to persuade the employee to download an “assignment” that let them invade the company’s systems.
In a related report, Binance explained, “Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.”
The report also provided additional details about the sophisticated monthslong scheme that not only involved the fake LinkedIn recruitment but also used a separate ad campaign that tricked another engineer into downloading a malicious version of a popular software package called Homebrew.
According to Binance, the engineer in question did not download the Homebrew software through the company’s regular channels, but instead clicked on an internet ad promoting a tampered version of it.
Binance says it detected the fake Homebrew download and removed it from the employee’s machine, but not before the hackers discovered critical information about the engineer’s role and others who managed the company’s wallets.
It was the combination of these exploits—the fake LinkedIn outreach and the knowledge gleaned from the tampered Homebrew download—that allowed the North Korean hackers to take over a series of Binance wallets and drain them of funds.
While many initially speculated that the hackers had used AI to break into Binance, the company’s account shows how they instead relied primarily on conventional phishing tactics. At the same time, Binance added that AI did play a role. This occurred when the hackers, after gaining control of the engineer’s laptop, used Binance’s own internal AI tools to compromise other accounts.
“The attacker leveraged the compromised computer of Engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer,” stated the Binance report.
A plague of North Korean “recruiters”
According to a Binance spokesperson, employees with non-public-facing roles are not allowed to maintain LinkedIn profiles. The spokesperson declined to explain if the engineer in question had violated that policy, or if either of the engineers would be terminated.
The phenomenon of North Korean hackers posing as recruiters has become a widespread problem across the corporate sector more broadly. In the case of Binance, the company said it flagged earlier efforts by hackers to target its employees on LinkedIn and that, in 2026, it had detected and prevented 57 North Korea–related hacking attempts.
Since the attack, which occurred over several hours on Thursday, the company has disclosed that the hackers stole around $6.3 billion, but that it was able to recover around $2.5 billion of that after two companies, Tether and Circle, moved to freeze stolen stablecoins.
In response to the hack, Binance shut down withdrawals for around 48 hours, but re-enabled them on Saturday. The company has repeatedly stated that all customer funds are safe and that it has replenished 98% of the stolen coins from reserve funds and other sources. It is in the process of acquiring the remaining 2%, which consist of lesser used currencies.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” said Binance in a statement.