The key facts

  • The hackers had been preparing the attack since June 2026, including through fake job interviews
  • On October 20, they gained access to Binance's transaction signing service
  • On the night of October 30, about $6.3 billion was withdrawn — the largest theft of digital assets in history

How the attack was prepared

Binance, the largest cryptocurrency exchange, has published a preliminary report on the record-breaking hack, in which it described the attackers' preparations. According to the report, which TASS cites in its article Gazeta.Ru, the hackers had been using a whole set of methods since June 2026: social engineering through fake job interviews, uploading malicious software, compromising internal AI tools, and a sophisticated method of authorizing transactions.

Two engineers and two interviews

The first link in the chain was an engineer from the wallet DevOps department: in June, he found a popular AI programming tool through a search engine and downloaded a modified version of homemade software to install it. As a result, the hackers uncovered the engineer's role and that of his colleagues in the wallet infrastructure. In September, on a job-search platform, the attackers found the profile of another exchange engineer and, having learned of his experience at Binance, contacted him posing as a project director. The employee went through a video interview with a fake recruiter, then a second interview with a person who introduced himself as the CEO of a fictitious company. In the end, he was asked to complete a test assignment on his work computer — the repository contained malicious code that executed upon installation.

The course of the hack and the scale of the theft

On October 20, the fraudsters used the compromised computer and, with the help of an AI tool, gained control over colleagues' data. On one employee's computer they found a container deployment token and, having obtained its credentials, penetrated an internal Binance service responsible for signing transactions, after which they carried out the theft. The hack itself took place on the night of October 30: about $6.3 billion in various cryptocurrencies was withdrawn from the exchange — the largest theft of digital assets in history. Separately, Binance had earlier denied rumors of a romance between its engineer and a North Korean spy; the report is, according to available information, preliminary, and final conclusions about the perpetrators are not yet provided in it.