Binance says North Korea-linked hackers stole about $6.34 billion after targeting an engineer through a fake job interview. A malicious coding assignment compromised his work laptop, while attackers also exploited internal AI tooling to reach wallet-signing systems.

Binance has published a preliminary investigation into the theft of about $6.3 billion from its platform. It says North Korea-linked hackers began with a fake job interview aimed at one of its engineers. A tampered file on a work laptop then gave the attackers a route into the exchange's wallet systems. The report is the most detailed account yet of how the heist unfolded.

Binance released the report and described a 'sophisticated, multi-stage campaign' that combined fake recruitment interviews, malicious downloads, a compromised internal AI tool, endpoint compromise and an advanced transaction-authorisation method. Co-CEO Richard Teng said on X that the full report was being published because the lessons go well beyond Binance. Binance puts the loss at roughly $6.34 billion, and says it is still investigating with independent security firms reviewing its findings.

An earlier warning in June

According to the report, the groundwork began months before the theft. In June, a wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool he had found through a search engine. Binance's security team spotted the anomaly, replaced the device and rotated the related credentials. By then, the attackers had learned who the engineer and his colleagues on the wallet infrastructure team were. Fortune reports the attacker also found that the engineer held a container deployment permission token on his machine.