The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.
That's according an initial assessment released by Binance on Tuesday about how it suffered the world's biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.
Those findings show the hackers first tried testing and penetrating Binance's security systems back in June, though the crypto exchange was able to detect that attempt and stop it.
Though unsuccessful, that attempt allowed the hackers — identified by the FBI as a North Korean military unit called TraderTraitor — to learn more about Binance and its systems.
Then, the hackers tried again. In September, a Binance engineer was contacted in a job-hunting platform by a person posing as a "project director" from a company that turned out to be fictious.
The engineer then conducted a first-round interview with a supposed HR representative from the fake company. The hackers used this interview to "build trust," with the Binance employee, the exchange said. The interviewer even shared supposed social media accounts, as well as personal photos and videos with the Binance engineer.
"This was more advanced and deceptive than previously seen social engineering approaches," Binance said in its assessment.
Then hackers pounced
The engineer was then told he would be conducting a second interview with the supposed CEO of the company in a popular social chat app. It was in this interview that the Binance employee — who was at his work laptop — was asked to download "an assignment" as part of the job recruitment process.
Instead, the "assignment" contained malicious code that allowed hackers to build out an attack that culminated last week when hackers made off with over $6 billion worth of crypto currencies held by Binance's customers at the exchange.
Binance said in the statement posted on X that the company is taking a series of actions, including an independent cybersecurity review to prevent future attacks. On Monday the exchange had said it had already replaced most of the stolen crypto currencies stolen by customers using its own funds.
"This should not have happened," Binance said in its assessment on Tuesday. "And we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
Copyright 2026 NPR