Binance says engineer downloaded malware that enabled $6,000 million crypto theft

Binance said on Tuesday that one of its employees was tricked by hackers posing as job recruiters, downloaded malware, and helped open the door to a theft of more than $6,000 million in cryptocurrency from the platform. For high-risk payment and crypto operators, the useful detail is not the headline number; it is the intrusion path: social engineering, internal access, and a compromise chain that moved from one infected workstation to platform-level control.

1. Binance said it has already reimbursed 98% of the stolen assets with its own funds. The remaining 2% was held in cryptocurrencies that are harder to source because of their scarcity, which makes recovery slower even when part of the loot has been frozen or traced.
2. According to the company, the attackers’ first move came in June, four months before the theft. They got an engineer to download a compromised version of Homebrew, a widely used programming tool, and the malware it contained exposed the engineer’s data and the data of other colleagues.
3. In September, the attackers approached another Binance engineer through a job platform and got that person to download malware with “sophisticated techniques,” the company said. Binance said that malware was key to the hack because it let the attackers establish a connection to the platform’s internal systems.
4. On 20 October, the attackers used the access they had obtained and an internal AI tool to take control of software used by two other engineers. Nine days later, they activated malicious code that launched the attack. The FBI has said the incident is linked to North Korean authorities; Pyongyang, through the sister of leader Kim Jong Un, called that accusation “absurd rhetoric.”
5. Binance said about $2,850 million of the stolen funds were frozen, meaning the attackers could not use that portion to swap into other coins. Binance is the world’s largest cryptocurrency exchange by daily trading volume, and the cyberattack news pushed most crypto prices down sharply.