On Tuesday, Binance revealed that North Korean hackers carried out last week's $6.3 billion heist through social engineering and malware, which is also the largest theft in the history of cryptocurrencies.
Company executives told reporters that hackers locked an Anbin engineer on LinkedIn and arranged a series of fake interviews in an attempt to persuade this employee to download a "task," thereby enabling them to infiltrate the company's system.
In a related report, Binance explained: 'Software engineer B was contacted through a legitimate job-seeking platform, where the person claimed to be the project director. Engineer B's profile on that platform mentioned his work experience at Binance. The so-called project director then arranged a first round of interviews with a human resources representative, followed by a second round of interviews with someone who claimed to be the CEO of a fictitious company.'
This report also provides more details about this complex operation that lasted for several months. In addition to forging the LinkedIn recruitment, the hackers also used another advertising campaign to trick another engineer into downloading a malicious version of the popular software package Homebrew earlier on.
According to Binance, the engineer involved did not download the Homebrew software through the company's regular channels, but clicked on a online advertisement promoting a tampered version of the software.
Binance stated that the company discovered this forged Homebrew download and removed it from the employee's device, but by that time, the hackers had already obtained critical information regarding the responsibilities of this engineer as well as other personnel responsible for managing the company's wallets.
Binance stated that it was the combination of these attack methods—faking LinkedIn contacts, as well as obtaining information from the tampered Homebrew downloads—that allowed North Korean hackers to take control of a series of Binance wallets and plunder the funds within them.
According to a spokesperson from Binance, employees in non-public-facing positions are not allowed to retain personal information marked with LinkedIn. The spokesperson refused to clarify whether the engineers involved violated this policy, nor did they confirm whether these two engineers will be dismissed.
The phenomenon of North Korean hackers impersonating recruiters has become a common issue in the broader business community. In the case of Binance, the company stated that they had previously identified early attempts by hackers to target their employees on LinkedIn, and claimed that they had detected and prevented 57 hacking attempts related to North Korea in 2026.
Since this attack that occurred on Thursday and lasted for several hours, the company disclosed that hackers stole approximately $6.3 billion, but about $2.5 billion of that amount has been recovered because two companies, Tether and Circle, have frozen the stolen stablecoins.
To respond to this hacker attack, Binance temporarily suspended withdrawals for about 48 hours before resuming on Saturday. The company has repeatedly assured that all customer funds are safe and that 98% of the stolen tokens have been replenished from reserve funds and other sources. The remaining 2% is still being replenished, and this portion mainly consists of less frequently used cryptocurrencies.
In a statement, Binance said: "This should not have happened, and we apologize for the concerns, disruptions, and uncertainties it has caused to our users, partners, and the broader industry."
