Binance CEO: “Hackers infiltrated for months

[Financial News, New York — By Lee Byeong-cheol, Correspondent] Hackers who stole assets worth $6.34 billion from Binance, the world’s largest cryptocurrency exchange, infiltrated its internal systems over a period of months using fake job interviews, malware, and artificial intelligence (AI) development tools, it has emerged. The hackers used sophisticated attacks targeting developers to obtain internal information, then breached the system that approves cryptocurrency wallet transactions. The U.S. Federal Bureau of Investigation (FBI) identified a North Korean hacking group as being behind the incident.
Richard Teng, co-CEO of Binance, appeared on CNBC on the 3rd (local time) and disclosed details of the major hacking incident that occurred on the 29th of last month.
Teng stressed that the incident was not a simple security breach originating from one employee’s laptop, saying, “The attackers spent months building pathways into the internal systems.”
The hack began in June. At the time, an engineer responsible for developing and operating Binance’s cryptocurrency wallet installed a modified development tool while searching for AI coding tools on a search engine. The hackers used malware disguised as legitimate software to obtain information about internal employees’ work and systems.
Binance later detected unusual activity, replaced the employee’s device, and changed their credentials, but some internal information had already been exposed to the hackers.
In September, the hackers targeted another engineer. This time, they posed as recruiters and conducted several fake job interviews. The coding assignments presented during the interviews contained malware designed to evade security detection.
Teng explained, “The attackers then quickly infiltrated the systems through internal AI tools and ultimately gained authorization to access the system that approves cryptocurrency wallet transactions.”
The attacks led to the largest cryptocurrency theft in history on the 29th of last month. On the 31st of last month, the FBI identified the North Korea-linked hacking group TraderTraitor as being behind the incident. Teng did not directly attribute the attack to North Korea, but acknowledged the FBI’s findings.
Binance has now replenished a substantial portion of the affected assets. Teng said the company had secured again, through its own funds and other means, 98% of the assets worth $6.34 billion affected by the hack. It is working to purchase the remaining assets, which it has not yet secured because of their low liquidity.
However, this does not mean that 98% of the stolen funds have been recovered. Binance has pledged to fully compensate customers for their losses and is using its own reserves to make up the shortfall in assets.
Binance and its cryptocurrency industry partners, including Tether, Circle, and Ripple (XRP), are reported to have frozen assets worth about $3 billion. Coinbase also blocked transfers of assets to wallets exposed to the hack and offered support to Binance.
Binance rebuilt the wallet systems affected by the hack and its internal AI tools, and replaced or deactivated the devices, credentials, and access tokens of the relevant employees. It also expanded security checks to cover all employee devices.
Teng said, “We are reviewing all the measures taken so far with independent outside experts,” and added, “We are working around the clock with law enforcement agencies and industry partners to trace the movement of the stolen funds and freeze them.”




[email protected] Lee Byeong-cheol, Correspondent Reporter