Binance said on Nov 4 that the Oct 29 theft of billions of dollars in crypto involved a months-long intrusion by suspected North Korean hackers who used fake job interviews, a malicious Homebrew download and compromised internal tooling to reach the exchange's wallet signing systems. The attackers spent months inside Binance's systems before gaining access to the exchange's internal wallet signing systems and stealing a massive sum, according to Ars Technica and Tom's Hardware.
How the attack worked: social engineering meets supply-chain compromise
According to Binance's disclosure, the attackers relied on three main methods: fake job interviews, a malicious Homebrew download and infected internal tools. Tom's Hardware reported that the attackers targeted developers with tampered software and social engineering.
Specifically, the attackers posed as recruiters in a fake interview process to approach Binance employees, luring them into downloading a Homebrew package laced with malicious code that infected their laptops. The attackers also compromised Binance's internal tooling to widen their access.
Ars Technica likewise reported that the techniques included laptop infections, compromised internal tooling and fake job interviews. Combined, these methods let the attackers move deeper into Binance's systems over months until they reached the wallet signing system at the heart of the exchange.
Security experts say the attack highlights the danger of combining social engineering with supply-chain compromise. The attackers exploited not only technical flaws but also human psychology and weak points in the development process, waging a long-term intrusion that traditional defenses struggle to stop.
Impact and reactions
The theft, involving billions of dollars in assets, is one of the largest crypto security incidents in recent memory. Binance did not disclose the exact amount stolen but confirmed that the attackers used the chain of methods above to gain access to the wallet signing system and carried out the theft on Oct 29. Binance has not yet announced further recovery efforts or a customer compensation plan.
Evidence suggests other criminal groups may copy this playbook, posing a continuing threat to crypto exchanges and tech companies.
What to watch
The investigation is ongoing. Key questions include whether Binance will release more technical details and the size of the loss; whether customer assets were affected and what compensation measures will follow; and whether regulators will impose new security requirements in response. In addition, while the attackers have been identified as North Korean hackers, the evidence has not been made public and awaits further verification.