Binance details a months-long attack behind a $6.34 billion crypto theft
Binance has published a postmortem describing what it says was a months-long operation that resulted in the loss of $6.34 billion in digital assets, making it the largest reported crypto theft to date.
The campaign reportedly began in June, when one developer downloaded a tampered installer through a malicious Google advertisement. The malware exposed information about Binance’s engineers and their working practices, giving the attackers a clearer picture of the company’s internal environment.
The operation continued in September with another apparent attempt to target an engineer. An attacker posing as a recruiter arranged repeated fake interviews and video calls, used social media pages to build trust, and encouraged the target to download a fraudulent interview application. This sequence fits Binance’s broader description of the intrusion as a combination of social engineering, laptop infections, and compromised internal tooling.
Together, these steps suggest that the theft was not the result of one isolated exploit. According to Binance’s account, the attackers spent months gathering information, establishing credibility, and gaining access before carrying out the final actions. The postmortem also says an internal AI tool was abused during the attack, highlighting how trusted development and workplace systems can become part of a longer intrusion chain.
The incident illustrates the risks posed when technical infrastructure and personnel are targeted in parallel. Traditional malware played a role, but so did deceptive recruiting contacts, counterfeit software, and access to internal systems—making employee security and software provenance as important as conventional vulnerability management.