The $6.3 billion cybertheft from cryptocurrency exchange Binance involved months of intelligence gathering, fake job interviews and the exploitation of internal artificial intelligence tools, experts told Anadolu, pointing to suspected North Korean involvement.
The operation, described as the largest cryptocurrency theft on record, highlighted how attackers can combine manipulation of employees with technical intrusions to compromise systems authorizing digital asset transfers.
Ari Redbord, global head of policy and government affairs at US blockchain analytics firm TRM Labs, attributed the attack to North Korea, saying cybertheft helps finance the sanctioned government and its weapons programs.
Ersin Dincelli, an associate professor of information systems at the University of Colorado Denver, said the case demonstrated the extensive reconnaissance and careful planning behind modern cyberattacks.
Fake recruitment opened door to company systems
According to Binance's report published Nov. 3, attackers first targeted an engineer in June when the employee attempted to install an AI-powered coding tool.
The company's security team detected suspicious activity and replaced the engineer's device and credentials. However, the attackers had already gathered information about the employee's responsibilities and colleagues.
In September, individuals posing as recruiters for a nonexistent company invited another Binance engineer to a fake job interview. A subsequent coding assignment prompted the employee to download files containing malicious code onto a work computer, giving attackers access to company systems.
On Oct. 20, the attackers used an internal AI tool to help gain access to two more engineers' computers.
They deployed malware on Oct. 29 using credentials stolen from another engineer and gained unauthorized access to an internal wallet-signing service used to approve transactions.
Within four minutes, they transferred 233.46 million XRP from five Binance wallets to an address under their control. Subsequent transfers included around 970,500 SOL, 44.2 million OP and 18,270 bitcoin.
Binance suspended withdrawals after detecting unusual transfers, but the attacker's existing permissions prevented the company from immediately stopping all unauthorized transactions.
The exchange said Oct. 30 that the incident's total impact was approximately $6.3 billion and that cooperation with industry partners had helped freeze around $3 billion in assets on the blockchain.
The amount stolen was roughly 4.2 times the approximately $1.5 billion taken from Bybit in February 2025, which had previously been the largest cryptocurrency theft on record.
Months of reconnaissance
Redbord said identifying wallet engineers by name, determining who held signing authority and understanding how teams worked together required months of research.
Job titles, professional profiles and conference participation could all help attackers identify targets and map their responsibilities, he said.
He described fake recruiters, fraudulent interviews and malicious coding assignments as recurring methods associated with North Korean operations. Engineers may take such approaches seriously because recruitment messages and coding tests appear to be routine parts of hiring.
Redbord said the operation's progression from an initial intrusion in June to the eventual theft reflected a patient intelligence operation, with each stage building on previously gained access.
He recommended running externally supplied code in disposable virtual environments on separate hardware. Exchanges should also impose hot-wallet limits, withdrawal caps and delays for large transfers, he added.
Experienced engineers remain vulnerable
Dincelli said even sophisticated technical safeguards can be undermined when employees are unaware of social engineering tactics that exploit curiosity, fear, urgency or other human motivations.
Experienced engineers can also fall victim to such schemes, he said, describing the Binance attack as a carefully coordinated operation conducted over several months.
Open-source intelligence tools and AI-powered automation have made it possible to gather information and build detailed profiles of potential targets at little or no cost, he added.
North Korea denies responsibility
The FBI accused North Korea on Oct. 31 of stealing $6.3 billion in digital assets from Binance, linking the operation to activity known as TraderTraitor. It urged cryptocurrency companies to block transactions involving associated addresses.
North Korea rejected the accusation. Kim Yo-jong, the sister of leader Kim Jong-un, accused Washington of attempting to portray Pyongyang as a cybercriminal state and suggested the US could benefit from recovering stolen cryptocurrency for its strategic reserves.
Dincelli said the distinction between state-backed cyberoperations and financially motivated crime was becoming increasingly blurred.
While state-sponsored attacks have traditionally focused on espionage and geopolitical objectives, North Korea illustrates how such operations can also be used to steal cryptocurrency and generate government revenue, he said.
