Binance says the biggest crypto theft on record began with two ordinary moments: an engineer downloading a popular tool, and another engineer taking a job interview.
Nobody "hacked the vault" in the way films suggest. The attackers spent months getting to the people who had the keys. That makes this a story for every business with developers, IT staff or admins, not just crypto firms.
What happened
Binance published its account of the incident on 3 November. It describes a "multi-stage campaign" that ended with billions of dollars leaving its wallets on Thursday 29 October.
The amount reported varies by source, from about $6.3 billion to $6.43 billion (The Hacker News reports $6.43 billion). Binance said it has frozen or intercepted around $2.85 billion, while other reports put the frozen figure between $2.5 billion and $2.8 billion. Treat all of these as approximate.
The fake job interview
In September, a second Binance engineer was approached through a job-hunting platform by someone posing as a project director. Binance says the engineer's profile mentioned his Binance experience. The sequence, as reported, went like this:
Round one: a video interview with a supposed HR representative, who shared a social media account full of personal photos and videos to look genuine.
Round two: an interview on a popular chat app with someone claiming to be the chief executive of a company that did not exist.
The "assignment": near the end, he was asked to download a coding task containing a malicious code repository, onto his work computer. The malicious code ran during setup. It used obfuscation to avoid detection, swapped a legitimate development tool component for a poisoned one, connected to a server run by the attacker and removed forensic traces.
Nothing about this required a software vulnerability. The engineer ran the code himself, because running a test project is a normal part of a developer's job interview.
The tampered installer from June
The interview was not the first step. In June, a Wallet DevOps engineer searched for a popular AI tool and installed a trojanised version of the Homebrew package manager.
Fortune reports that the engineer reached it through an internet ad rather than Binance's usual software channels.
Binance spotted the problem and rotated credentials, but the attackers had already learned who managed its wallets and who their colleagues were. That gave them a list of people worth approaching.
The internal AI tool
On 20 October, Binance says, the attacker used the interviewed engineer's compromised computer to abuse an internal AI tool and take control of two other engineers' machines. One of them held a token that allowed containers to be deployed.
On 29 October that token was used to run a malicious script, and the attacker then reached an internal wallet signing service to start transactions outside the normal withdrawal process. Binance has not published more detail on the AI tool itself.
Who was behind it?
Reports say North Korea. Blockchain analytics firm Chainalysis attributes it to a North Korean group called TraderTraitor, but describes that as an intelligence assessment based on on-chain activity, mainly stolen funds mixing with money from an earlier theft linked to North Korea. Other reports say the FBI has linked the attack to North Korea, and Fortune reports Binance attributes it to North Korean hackers.
Chainalysis also says it has identified dozens of similar fake-interview compromises, with more than $14.3 million lost to them over the past 18 months. Binance says it blocked 57 suspected North Korea-linked attacks this year.
Are customers affected?
Binance says customer funds are safe and that it has replaced 98% of the affected assets, with withdrawals being reopened in phases. Reports differ on the details of the withdrawal pause, so check Binance's own updates if you hold funds there.
The company has said the entry points used have been closed and has rebuilt the affected wallet system and the internal AI tool.
What this means for UK small businesses
You are unlikely to hold billions in a crypto wallet. But you probably have a developer, an IT lead or an MSP engineer with powerful access, and they get messages from recruiters too.
The attack chain was a trusted-looking approach, a request to run something on a work laptop, and then stolen access passed from one machine to the next. Each step is something a small business can plan for.
What to do this week
Never run a stranger's code on a work device. That includes interview tasks, "assignments" and sample projects. If staff want to look at one, use a separate personal machine or disposable virtual machine with nothing important on it.
Install software from official sources only. Go to the vendor's own website or your approved software list, not the first search ad.
Cut down what is stored on laptops. A deployment token on one machine was used to reach another. Keep long-lived tokens and admin credentials out of everyday devices, and give them short lives where you can.
Review what your internal tools and AI assistants can reach. If a tool can act on other people's machines or systems, treat it like an admin account: limit it and log what it does.
Brief your technical staff. Tell them recruiters can be attackers, especially for people with privileged access, and that they can say so if something feels off. Make it easy to report a suspicious approach without blame.
Sophia Says
What stands out to me is how patient this was. Months passed between the first tampered installer and the theft, and at no point did anyone have to break through a firewall. The attackers went after people and the trust attached to their jobs.
That is why I keep telling small businesses the same thing: know your people, know your exposure and keep checking both. A team that has been shown what a fake recruiter looks like is far harder to fool, and a business that knows what attackers can see about it can close gaps before anyone else finds them.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Preparing your people: Security Awareness Training explained, including how it helps staff spot social engineering.
Testing the approach: Phishing Simulations let you see how staff respond to a realistic lure before a real one arrives.
Stolen logins: a Dark Web Scan checks whether your business credentials have turned up in leaked data.
What is exposed: a Recon Scan shows what an attacker can see of your business from the internet.
