Binance hack: how $6.3bn was taken, and what was frozen

Binance has published an account of how its cryptocurrency exchange was compromised in a $6.3bn heist. The company says the operation began in June with an engineer who downloaded malware by mistake. That download exposed the employee's role and the roles of others on the team responsible for Binance's cryptowallet infrastructure. The company called the incident something that should not have happened and apologised for the concern and disruption it caused to users, partners and the wider industry. The FBI has blamed North Korea for the raid, which Binance says took place last week.

A fake project director approached a second engineer on a legitimate job-hunting platform, according to Binance. That led to a first-round video interview with a sham HR representative. A second-round interview followed on a chat app with the “chief executive” of a fictitious company. During that second interview, the engineer was tricked into downloading malware onto his computer. The company says the recruitment scam took place in September.

On 20 October, the attacker used the compromised computer and an internal AI tool to take control of the engineer's system and that of a second wallet developer on the same team. On 29 October, the attacker used the second developer's computer with credentials stolen from the first engineer. That triggered a malicious script to launch the attack on “hot wallets”, where billions of dollars worth of crypto-assets were held.

Binance says $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted. The company put the overall heist at $6.3bn, or £4.7bn.

The FBI said on Saturday that North Korea was responsible for the hack. Kim Yo-jong, sister of the North Korean leader, rejected the claim on Tuesday. According to North Korea's state news agency, KCNA, she said the FBI was trying to brand the country a “cybercriminal state”. She called the US assertion absurd rhetoric and nothing new, and described it as a grave political provocation.