Binance, the major cryptocurrency exchange, on November 3 published a report detailing the methods and timeline of the approximately $6.3 billion (roughly ¥1 trillion) cryptocurrency outflow incident that came to light last week. The company believes North Korea was involved in the attack, describing it as a "sophisticated, multi-stage operation" that combined multiple techniques over several months, including contact under the guise of job interviews and intrusion exploiting artificial intelligence (AI) development tools. North Korea has denied involvement.
According to the report, the attack originated in September when one of the company's software engineers was contacted through a legitimate job-change website by someone posing as a project manager at a fictitious company. During the first interview, a person posing as an HR representative joined a video call and attempted to build trust by showing what appeared to be a genuine social media profile featuring personal photos and videos. It was during the second-round interview, after trust had been established, that the engineer was induced to download a set of development files containing malicious programs as a hiring assignment.
Separately, another engineer in June had imported a tampered installation file of the package management software "Homebrew" onto their computer while attempting to install an AI tool for software development. The company's security team detected the anomaly, replaced the device, and updated all credentials, but information on this engineer and colleagues was reportedly obtained by the attackers.
Binance co-CEO Richard Teng said, "This was not an incident caused by a single mistake or intrusion, but an attack meticulously orchestrated over several months," indicating his view that it was not simple negligence but organized preparatory work.
The company says it has detected and blocked 57 cyberattacks believed to be linked to North Korea since the start of 2026. These include methods using fake job interviews and tampered software packages.
As of October 29, when the incident was first reported, the company had said attackers may have breached an engineer's laptop and used it as a foothold to withdraw cryptocurrency from the exchange. It later said the attack was "complex" and that other intrusion routes had been found, but did not disclose details at the time. The latest report represents a further unraveling of the full picture.
The outflow amount is the largest ever for a cryptocurrency hack. After the incident came to light, stablecoin giants Tether and Circle Internet Group, among others, froze approximately $3 billion (roughly ¥480 billion) in funds, blocking the attackers' movement of funds. Analysis firms tracked the flow of cryptocurrency and ultimately pointed to North Korean involvement.
Binance said it would absorb the losses itself, seeking to reassure users. However, it halted withdrawals for nearly two days after the incident, gradually resuming them from the early hours of November 1. Initially, a rush of withdrawals saw several billion dollars in funds flow out, but calm later returned, and on November 3 the company announced that hourly deposits had come to exceed withdrawals. It also said it had nearly replenished the lost cryptocurrency using its own funds and two insurance funds.
The market impact was limited. Bitcoin fell more than 4% immediately after the incident, briefly dropping to near $76,000, but later pared its losses and was trading in the mid-$77,000 range on November 3.
Note: Based on Binance's published materials and media reports.
The series of methods is regarded as a typical example of what is called "social engineering"—techniques that exploit human psychology and behavior. Attackers are not only infiltrating companies by posing as job seekers but also approaching employees of cryptocurrency firms by posing as recruiters—exploiting "both sides of the hiring process." According to data from security firm Pindrop Security, applications by North Korean job seekers surged from 1 in 343 last year to 1 in 47 this year, suggesting an expansion of tactics driven by tightening conditions in the hiring market.
The case has highlighted the reality that, as competition for talent intensifies and cyberattacks grow more sophisticated simultaneously for cryptocurrency exchanges, the hiring process itself has become a new attack target. In light of this incident, Binance may be forced to review how interview assignments are distributed and how devices are managed. Across the industry, vigilance is likely to increase regarding malware infections via job sites and interview tools.
