Binance said hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure, leading to the record-breaking Oct. 29 cyberattack that resulted in more than $6 billion in assets being stolen from the world's largest crypto exchange.
The attackers "spent months building their way in," Binance co-CEO Richard Teng told CNBC's "Squawk on the Street" Tuesday, rejecting suggestions that there was a single point of failure through one employee's laptop.
"In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that," he added. "In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security ... from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction."
He also said Binance has replenished 98% of $6.34 billion in affected assets, and that it is still in the process of purchasing outstanding, more illiquid assets.
Teng himself did not attributed the attack to North Korea but acknowledged that the FBI has linked it to North Korean hackers tied to the TraderTraitor group.
June preparations
Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation "to install a popular AI coding tool after searching for it on a search engine," according to a security report published by Binance Tuesday. It said it detected the suspicious activity, replaced the engineer's device and rotated credentials as a precaution, but that by then the employee's "role and his related colleagues on our wallet infrastructure team was exposed to the hacker."
As Binance works to recover from the incident, it has temporarily restricted certain withdrawals, pledged to cover all customer losses and tapped its own reserves to replenish affected assets. Binance and industry partners including Tether, Circle and Ripple have reportedly frozen about $3 billion in assets, though some stolen funds continue to move through laundered channels. Coinbase blocked transfers to compromised wallets and offered Binance direct assistance.
Although the incident represents a significant security breach, Binance maintains that it remains financially sound and focused on identifying the vulnerability, recovering remaining funds and preventing another attack.
The hack sparked a sharp but short-lived hit to confidence across crypto markets, especially compared with previous failures at major exchanges. Investors are now watching whether Binance can fully restore confidence in centralized exchanges.
As of Tuesday Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with the affected engineers and expanded security scans across employee devices, Teng told "Squawk on the Street."
"We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said. "We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front."