Inside the $6.3 Billion Binance Heist

The sophisticated social engineering campaign targeted a software engineer within the company’s wallet division. After multiple rounds of interviews, the employee was instructed to download a coding assignment that contained hidden malicious code. Binance confirmed that its internal security tools failed to flag the file, providing the attackers with an initial foothold on a work-issued laptop.

From that single device, the hackers pivoted through the company’s network by compromising the credentials of two additional engineers. One of these accounts had been previously exposed months earlier when an engineer downloaded a tainted application from search engine results. Using these stolen credentials, the intruders escalated their access until they reached systems capable of managing the platform’s massive crypto reserves. FBI investigators and blockchain analysts have since identified the operation as the work of North Korean state-sponsored actors, who rely on such tactics to fund sanctioned nuclear programs.

Despite years of industry warnings regarding fake recruiters and venture capitalists, the breach highlights a systemic vulnerability in how major tech firms manage employee endpoint security. Binance spokesperson Ross O’Leary declined to comment on specific internal failures, including why unauthorized code could execute on company hardware. The exchange has since engaged outside cybersecurity experts to conduct a review and claims to have implemented new defensive measures to prevent a recurrence of the theft.