Binance Details Social Engineering Attack Behind $6.34 Billion Cryptocurrency Theft

Cryptocurrency exchange Binance revealed details of a security breach resulting in the theft of $6.34 billion, attributing the compromise to a social engineering scheme targeting an internal engineer. The attackers allegedly used a fraudulent job recruitment process to gain unauthorized access to the firm's central systems.

According to an internal investigation published by the platform, suspected North Korean cybercriminals initiated contact with the engineer through professional networks. The attacker posed as a recruiter offering a lucrative employment opportunity, eventually directing the employee to download a malicious file disguised as a technical assessment.

Once executed, the malware provided the threat actors with remote access credentials, allowing them to bypass internal security controls. The compromise enabled the unauthorized transfer of digital assets over several transactions before automated monitoring systems detected the abnormal activity and halted further withdrawals.

Binance stated that forensic analysis confirmed the infrastructure and techniques used in the breach aligned with state-sponsored hacking groups operating out of North Korea. The company has since revoked the compromised credentials, updated its endpoint security protocols, and engaged federal law enforcement agencies to track the movement of the stolen funds.

The incident represents one of the largest single cryptocurrency thefts recorded to date. Security experts continue to warn that high-value technology platforms remain primary targets for targeted spear-phishing tactics designed to circumvent traditional perimeter defenses.