Binance Says $6.34 Billion Hack Began Months Earlier With Supply Chain Compromise and Fake Job Interviews

Binance said its $6.34 billion exchange hack did not start last week; it started in June, with attackers moving through its systems in stages before draining hot wallets. For high-risk PSPs, the useful part here is not the headline number but the attack path: supply chain compromise, social engineering, and internal tooling all showed up in the same incident.

1. In its initial report released Tuesday, Nov. 3, Binance said the breach came after “attackers spent months working their way into its systems through a supply chain compromise, fake job interviews and an internal AI tool before taking control of hot wallets.”
2. The company said the campaign began in June, when an engineer on Binance’s wallet infrastructure team downloaded a tampered installer while setting up a popular AI coding tool. In September, a second Binance engineer was approached on a legitimate job platform and downloaded malware included in a coding assignment during what turned out to be a fake job interview.
3. Binance said the attackers then used the compromised computer to find a container deployment permission on another wallet engineer’s machine on Oct. 20. On Thursday, Oct. 29, they used stolen credentials to deploy a container and launch the attack.
4. The exchange said it is keeping some technical details confidential so it does not help future attackers. It also said its security team had already detected and blocked 57 other suspected North Korea-linked threats this year before this incident.
5. Binance said it has brought in independent cybersecurity firms to review the incident and validate its findings, is increasing investment in AI-based security, and is working on a security research fund with AI companies and security firms focused on AI security in blockchain.

Binance said its emergency reserve and corporate funds would cover all losses, and in its Tuesday update said users are fully covered. The company said it has replenished 98% of the affected token assets and is buying the remaining tokens, while about $2.85 billion of the $6.34 billion in digital assets affected has been frozen or intercepted so far.