Binance says a fake recruitment process helped attackers gain the access used in a theft of approximately $6.3 billion in digital assets. VnExpress’s 3 November report sets out the exchange’s preliminary account of compromised employee computers and subsequent access to wallet engineers.
Security chief Jimmy Su said an engineer looking for another job was approached in September. A programming exercise downloaded onto a work computer contained malware that the company said evaded endpoint protection.
The company’s incident timeline
Binance described another intrusion in June involving a modified Homebrew package encountered by an engineer seeking AI tools. It said that on 20 October, the computer compromised through the fake interview and an internal AI tool were used to reach two wallet engineers.
According to the exchange, funds began leaving at 20:05 UTC on 29 October, equivalent to 03:05 Vietnam time on 30 October. These are the events presented in its initial investigation.
Restoration claims and an external review
The 3 November update said around $2.85 billion in related assets had been frozen and approximately 98% of affected tokens restored. A separate VnExpress report recorded Binance’s earlier 95% restoration statement on 1 November, placing those figures at different points in the response.
VnExpress, citing Reuters, reported the FBI’s attribution to the North Korea-linked TraderTraitor group. VnExpress also cited AP’s report of Kim Yo Jong rejecting the allegation.
Binance plans to bring in independent cybersecurity specialists to assess the incident and increase investment in threat detection. That outside review is a proposed next step; the restoration figures remain the exchange’s own account.