The hackers behind the record-breaking Binance theft spent months planning a complex attack that involved fake job interviews, false identities and malicious software. The attackers reportedly gained the trust of an engineer before convincing the employee to download a harmful file onto a work computer.
Binance revealed the details of the attack on Tuesday. The company said the hackers used a carefully planned process to target employees and gain access to internal systems. The operation involved several stages and did not depend on a single security failure.
The attackers first contacted an engineer while pretending to be recruiters. They arranged two rounds of job interviews as part of their plan. During the first interview, a person claiming to work in human resources spoke with the engineer and shared social media details to appear trustworthy.
A second person later joined the process. This individual claimed to be the chief executive of a fake company. The person then asked the engineer to download a file as part of an interview assessment.
However, the file contained malware. Once the employee downloaded it, the hackers gained another way to access the engineer’s work computer. This allowed them to move deeper into the company’s systems.
Binance co-CEO Richard Teng described the incident as a complex attack. In a social media post on Monday, he said the attackers had also used a self-destruct feature to remove their tools and traces of activity.
The company said the fake interview was only one part of a much wider operation. Its investigation found that the attack had started months earlier, in June. During that period, another engineer downloaded a popular artificial intelligence coding tool that had been compromised.
Binance said more employee devices were affected as the campaign continued. The hackers gradually expanded their access before reaching systems connected to the approval of cryptocurrency wallet transactions.
One key stage took place on October 20. According to Binance, the attackers used the engineer’s laptop, which had been compromised through the fake interview process, to gain access to the computers of two other employees.
The hackers also used an internal artificial intelligence tool during the operation. However, Binance did not explain how the tool was involved or what tasks it performed.
Several days later, the attackers used stolen login details to activate the malware responsible for the unauthorized transfers. This allowed them to reach systems used in wallet transactions and carry out the theft.
Binance’s first findings pointed to one compromised laptop. However, a wider review showed that the incident involved several security breaches across the company. The findings suggested that the hackers had spent months building access rather than relying on one attack.
The theft had a major impact on the cryptocurrency industry. Binance temporarily suspended withdrawals late last week while it reviewed the incident and worked to protect customer funds. The company restored withdrawals on Sunday.
Soon after the attack, Binance announced that it would cover all customer losses through its Secure Asset Fund for Users. The fund was created to provide protection for users in the event of serious security incidents.
Stablecoin companies Tether and Circle also helped limit the damage. They were able to freeze slightly less than half of the stolen assets, preventing those funds from being moved or used.
Binance later provided an update on customer activity. By late Sunday night Eastern Time, the exchange had processed about $4.649 billion in withdrawals and around $1.01 billion in deposits.
The company also said it had replenished 98% of the affected assets. It maintained that customer funds remained protected despite the scale of the incident.
Binance founder Changpeng Zhao, widely known as CZ, discussed the situation in an interview with Yahoo Finance on Tuesday morning.
He described the response as a hectic process but said the exchange had returned to normal operations. He added that withdrawals had been restored and users could access the platform without major problems.
Zhao also stressed that Binance had covered customer funds and that users had not suffered financial losses from the incident.
The attack has raised concerns about the growing risks facing cryptocurrency companies. It also shows how hackers can use social engineering to target employees instead of trying to break through technical security systems directly.
Fake recruiters and false job offers can appear convincing, especially when attackers spend time building trust. By using interviews and professional profiles, criminals can make harmful files look like normal work documents.
The Binance investigation is still an important part of understanding how the theft happened. The company has not shared every technical detail of the operation, but its findings show that the hackers used a long-term plan involving several employees and internal systems.
The incident also highlights the need for stronger employee checks and better protection against malicious software. As cryptocurrency platforms handle large amounts of digital assets, even a single compromised device can create serious security risks.
