Binance said Tuesday that hackers it attributes to North Korea stole $6.3 billion from the exchange using fake job interviews and malicious software disguised as developer tools, according to Bloomberg. The company called the breach a "sophisticated, multi-stage campaign" in an incident report published Tuesday.

The FBI has attributed the attack to North Korean hackers. North Korea denies the claim, and on Monday the sister of leader Kim Jong-un called the FBI's assertion a "grave political provocation," according to The Block.

How did the attack unfold?

The campaign began in June, when an employee who builds Binance's wallets installed a doctored AI tool, Reuters reported. Binance detected the compromise, swapped out the device and reset credentials, but the attacker still learned the employee's role and the roles of teammates on the wallet team.

In September, a second software engineer was approached on a job-hunting platform by someone posing as a project director, according to Bloomberg. The engineer then interviewed over a social messaging app with a figure presented as the CEO of an invented company, and was instructed to download an assignment containing what Binance described as a "malicious code repository."

The theft itself came in two steps:

• On Oct. 20, the attackers used an internal AI tool together with the second engineer's infected computer to seize command of devices belonging to two other engineers, The Block reported.
• On Oct. 29, the attackers logged in with stolen credentials, set up a container and ran a malicious script that initiated the theft from the wallet.

"This was not a single mistake or a single breach. It was a campaign built over many months," Binance Co-CEO Richard Teng said, according to Bloomberg. Teng said the attackers combined sham hiring interviews, malware posing as genuine developer tools, hijacked devices and AI-driven methods.

How much money has been recovered?

Binance has frozen or intercepted roughly $2.85 billion of the stolen assets — about 45% of the total — and has restored 98% of the affected assets, The Block reported. The exchange has said it will reimburse every customer who lost money, according to Reuters.

Binance paused withdrawals after the incident and resumed them on Sunday, Bloomberg reported. By Tuesday, deposits per hour had begun to outpace withdrawals per hour — an early sign that user confidence was stabilizing rather than draining.

What has Binance changed?

The company said it has shut the entry points the attackers exploited, replaced or rebuilt the systems that were hit, tightened controls on devices and broadened its AI-based anomaly detection, according to The Block.

Binance also disclosed that it caught and stopped 57 attacks in 2026 that it suspects were tied to North Korea, many relying on methods comparable to those used in the $6.3 billion theft.

The scale of the attempt matters beyond one exchange. The stolen sum exceeds the annual economic output of several small nations, and the attack chain — a doctored AI tool, a fabricated recruiter, a fake CEO on a messaging app — required no exploit of Binance's core trading infrastructure, only deception aimed at individual employees.