Wire reporting: (Reuters, via CNA)

Binance said Tuesday that attackers spent months using a tampered software installer, fake job interviews and the exchange’s own internal AI tooling before draining about $6.34 billion in digital assets on Oct. 29^1,2,5.

The FBI has attributed the theft to TraderTraitor, a North Korean hacking unit, according to Binance’s account as reported by The Verge and Engadget^1,2. Binance co-CEO Richard Teng told CNBC he was not himself making that attribution while acknowledging the FBI’s finding⁷.

Binance’s incident report, as summarized by several outlets, said the campaign began in June when a wallet DevOps engineer downloaded a tampered Homebrew installer for a popular AI coding tool found through a search engine^1,2,5. The company said it detected that incident and replaced the device, but information about the engineer’s role and wallet-team colleagues was exposed^2,5.

In September, a second software engineer was contacted on a job-hunting platform by someone posing as a project director and completed two interviews, including a video session with a purported HR representative who shared a social-media account to build trust^1,3,5. A supposed CEO then sent an assignment that contained malware executed on a work computer during setup^1,3,5.

Binance said the malware used obfuscation, including replacing a legitimate development-tool component, and was not caught by endpoint tools at the time^2,5. On Oct. 20, attackers used a compromised machine and an internal AI tool to reach other engineers’ systems, then on Oct. 29 used stolen credentials to trigger a malicious script and move assets^1,2.

The Verge reported Binance’s explanation that multi-party computation on a hot wallet and EIP-7702 authorizations meant there was no single key to revoke transfers immediately, so some movement continued after withdrawals were paused². Engadget said $2.85 billion of the $6.34 billion had been frozen and that Binance would absorb remaining losses¹. CNBC said the company reported replenishing 98 percent of affected assets⁷.

The Hacker News put the stolen amount at $6.43 billion, higher than the $6.34 billion cited by Engadget, CNBC and The Korea Herald^1,5,7,10. The Japan Times said Binance paused withdrawals for almost two days and pledged to bear the financial cost¹¹.

Teng told CNBC the attackers spent months getting in and rejected the idea of a single point of failure on one laptop⁷. The Korea Herald, citing Yonhap, quoted a U.S. State Department spokesman calling DPRK cybercrime a global problem when asked about North Korea’s latest claim^10,12. What remains unclear in the public record is independent forensic confirmation of each internal step beyond Binance’s report^2,5.