The Interview Behind the $6bn Heist: Crypto's Biggest Thefts Start With People, Not Code

1. Five months to get in, four hours to get out

The largest theft in crypto's history was won by working on people, not by breaking code. Binance's initial report on the theft of about $6.34bn on 29 October, published on 3 November, describes "a sophisticated, multi-stage campaign" that ran from June to October and combined fake recruitment interviews, malicious downloads and compromised internal AI tooling. "It was not a single isolated breach or a simple phishing incident," the exchange writes.

The first door opened in June. An engineer on Binance's wallet DevOps team, whom the report calls A, downloaded a tampered installation of Homebrew, a package manager widely used on Macs, while trying to install a popular AI coding tool he had searched for on a search engine. Binance caught it, replaced the device and rotated all related credentials, but his role and those of his colleagues on the wallet infrastructure team had been exposed to the attacker.

In September a software engineer, B, whose profile on a legitimate job-hunting platform mentioned his time at Binance, was approached by a supposed project director, interviewed on video by a fake HR representative, then in a chat app by the "CEO" of a fictitious company, and told to download an "assignment" onto his work computer. Its code ran during setup and planted malware that Binance's endpoint security tools did not detect.

On 20 October the attacker used B's machine and an internal AI tool to gain control over A and a third engineer, C, and soon found a container deployment permission token on A's computer. On 29 October, between 17:15 and 19:56, it logged on to C's computer with credentials stolen from A, deployed a container and triggered a malicious script to launch the attack, which ran through the internal wallet signing service; the first stolen transfers began at 20:05 UTC.

Richard Teng, Binance's co-chief executive, wrote on X: "This wasn't one mistake or one breach", calling it "a months-long campaign". On 31 October the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets", naming the activity TraderTraitor, as it did after the Bybit theft of February 2025. Kim Yo Jong, sister of the North Korean leader, called the US accusation "a grave political provocation against the DPRK" in a statement carried by KCNA, the state news agency, and reported by Yonhap on 3 November.

Once inside the signing service, the attacker outran the shutdown. Suspending withdrawals did not stop delegations set up through EIP-7702, an Ethereum mechanism that lets a wallet hand execution rights to a smart contract, and because the hot wallet used multi-party computation (MPC) there was "no single private key" with which to revoke them at once; the last unauthorised transfer, of 2,961.9 ether, settled at 23:56 UTC, and the delegation was cleared at 00:10 on 30 October. The report bears out what Le Détroit inferred from the Ethereum record on 30 October: the thief borrowed signatures rather than stealing a key. Binance says about $2.85bn has been frozen or intercepted and that it had replenished 98% of the affected assets by 31 October, at its own expense.

2. The costliest thefts start with people

Binance is no outlier: in crypto, the biggest thefts start with a person, while code bugs cause more thefts but smaller ones. To test that, Le Détroit classified the 18 thefts of $150m or more from crypto firms and protocols since January 2022 listed by rekt.news, which tracks such incidents, plus Binance's, by how the attackers first got in, as published by the victims or their investigators. Five began with a person who was deceived, the three largest among them, and they account for $9.0bn of the $13.0bn stolen, or 69%, and still 40% once Binance is set aside. Eight began with a flaw in code, more than any other route, but they account for only 17% of the value.

At Ronin, the network behind the game Axie Infinity, a senior engineer applied to a company that did not exist after an approach on LinkedIn; the job offer, a PDF, let spyware into Ronin's systems, The Block reported, and $624m left in March 2022. At DMM Bitcoin in May 2024, a fake LinkedIn recruiter gave an employee of Ginco, a wallet software supplier, a pre-employment test whose code compromised the employee's computer, the FBI said; 4,502.9 bitcoin, worth $308m, were taken. Bybit lost about $1.5bn in February 2025 after a developer at its wallet software supplier, Safe{Wallet}, was sent malicious code "under the guise of a pre-employment test", in the words of sanctions monitors from 11 countries. In April 2026 Drift, a trading protocol, lost $285m after a group posing as a trading firm courted its contributors for about six months.

The pattern has limits that matter: three of the 19 cases, including FTX's outflows of November 2022, have no settled cause. Kelp DAO's $290m loss in April went through compromised servers at its supplier, LayerZero, whose initial breach has not been explained, and Bitget's $387.5m theft in September through flaws in third-party security products, with no lure described. Beyond crypto, Verizon's 2026 breach report finds that software vulnerabilities, at 31% of breaches, have overtaken stolen credentials as the commonest way in. In crypto, though, the money sits behind the people who hold signing power: compromises of private-key infrastructure and signing processes at centralised services caused 88% of losses in the first quarter of 2025, Chainalysis found.

3. The staff map is public

Attackers do not have to break in to map a company's staff: professional networks show who works where. Binance's report says B's profile on the job platform "referenced his experience at Binance", and that the June incident exposed A's role and his colleagues on the wallet team. Screenshots supplied to Le Détroit show how little effort that mapping takes: a list of LinkedIn members, displayed in Chinese, who give Binance as their current employer, with job titles from internal audit to risk control, and their cities. Le Détroit has blurred the faces and locations.

Document

Who works where, in public

LinkedIn members who give Binance as their current employer, by job title, and a work-history entry reading “Senior Software Engineer, Binance”

LinkedIn listings shown in Chinese (领英会员 means “LinkedIn member”), faces and locations blurred

A profile’s work history: 高级软件工程师 means “senior software engineer”

The approach that follows is a script, and it has barely changed in four years. In April 2022 the FBI, the Cybersecurity and Infrastructure Security Agency and the US Treasury warned that North Korean intrusions, built around malware-laced apps they called TraderTraitor, begin with messages to crypto employees that "often mimic a recruitment effort and offer high-paying jobs", aimed especially at DevOps and system administration staff. In 2023 Palo Alto Networks' Unit 42 documented a campaign bearing North Korean hallmarks, which it named Contagious Interview, in which fake employers get developers to install a code package that carries malware. In December 2025 Chainalysis said North Korean operators were "impersonating recruiters for prominent web3 and AI firms, orchestrating fake hiring processes" that end in "technical screens".

What set the September lure apart was its realism. The fake HR interviewer shared a social media account with personal photos and videos to build trust, an approach Binance calls "more advanced and deceptive than previously seen". The constant, across six thefts, is the file: an offer, a test or a repository, opened by the target on a machine that matters.

Illustration

The shape of the lure

An illustration, marked as such, of an offer with two interview rounds, HR then CEO, ending in a take-home assignment

4. Fifty-seven stopped, and three ways in

Binance was not careless, which is the uncomfortable point: its defences stopped dozens of attempts and still lost to one. The report says its security team detected and prevented 57 suspected North Korea-linked cases in 2026, using fake interviews, malicious software disguised as popular developer tools, compromised packages and browser extensions, and fake video-conferencing apps. Its red team phishes staff every month, sometimes posing as recruiters, and repeated failures weigh on an employee's rating, Jimmy Su, its security chief, told Cointelegraph in July: "We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving."

Luring an employee is one of three ways in through people, and each tests a different defence. Bribery gets past training: in May 2025 Coinbase said criminals had obtained customer data by "paying multiple contractors or employees working in support roles outside the United States", then demanded $20m; it put its likely costs at $180m to $400m, though no passwords or private keys were taken. Fake hires get past the interview: in June 2025 the US Justice Department alleged that North Korean IT workers had obtained jobs at more than 100 US companies, announced searches of 29 known or suspected "laptop farms" in 16 states and charged four North Koreans over the theft of more than $900,000 in crypto from two companies.

Binance meets the third door daily. Mr Su told Decrypt in 2025 that Binance is inundated with fake résumés, which he believes come from North Korean applicants, and that such candidates use voice changers and deepfakes in video interviews; asking a candidate to put a hand over the face usually breaks the fake, the outlet reported. The sanctions monitors estimate that 1,000 to 1,500 North Korean IT workers are based in China alone, and Chainalysis calls embedding them "one of DPRK's principal attack vectors".

5. AI was the bait, then the bridge

Artificial intelligence sits at both ends of this chain, and in the cure. The June bait was an AI coding tool: engineer A went looking for it through a search engine, and the Homebrew installation he downloaded to get it had been tampered with. Fake Homebrew downloads are an established trick: in January 2025 BleepingComputer described a Google ad that displayed Homebrew's real address but led to a lookalike site serving a Mac infostealer. Binance does not say which AI tool, or which search engine, was involved.

Document

A sponsored result labelled malicious

A Google search for “homebrew” showing a sponsored “Homebrew macOS” result under the address business.google.com

The bridge was Binance's own AI tool. On 20 October the attacker "used an internal AI tool to gain control" over engineers A and C, the report says, without explaining how; Binance has since rebuilt the tool and its access controls. Le Détroit's reading: an internal AI tool that can act on engineers' machines is a privileged identity, and whoever controls one engineer's session can borrow its reach over the others. The OWASP project's guidance on AI applications calls this "excessive agency" and advises limiting the permissions such tools get "to the minimum necessary", with a human approving high-impact actions.

The cure is AI too. Binance says it has "expanded AI-based behavioural anomaly detection" and is working on a security research fund with leading AI companies. Detection did its job in June; in September the malware was a 0-day that "was not detected by the endpoint security protection tools at the time". Verizon's 2026 report finds generative AI bolstering 15% of attack techniques: the same tools now work on both sides of the door.

6. Architecture, not exhortation

Training can address only the first two doors; the other three were design choices, and changing any one could have broken the chain. The attacker needed a work computer that ran a stranger's code, an AI tool that could reach other engineers' machines, a deployment token kept on an engineer's computer and a signing service that accepted transactions "outside the normal withdrawal process". Binance's fixes follow the same list: tighter device controls, a rebuilt AI tool, decommissioned tokens and "enhanced wallet-service risk controls".

Some of these controls are already law for some firms and advice for others. The EU's Digital Operational Resilience Act, which has applied to financial firms since 17 January 2025, requires them to limit access to systems "to what is required for legitimate and approved functions and activities only", and makes security training compulsory. In its first analysis of the theft, TRM Labs, a blockchain analytics firm, urged signing policies that reject EIP-7702 authorisations "unless they are expected", and treasury teams to "monitor Ethereum-compatible wallets for EIP-7702 delegations" with a tested way to revoke them.

7. What the money buys

One theft has nearly doubled what had been counted as North Korea's crypto haul. Chainalysis put the regime's take at $2.02bn in 2025 and its cumulative lower-bound total at $6.75bn; the $6.34bn taken from Binance equals 94% of that. Elliptic had already tracked more than $1bn stolen by North Korea-linked actors in 2026 before 29 October, so by Le Détroit's sum this year's haul exceeds $7.3bn, more than three times the $2.02bn Chainalysis counted for 2025.

The money matters beyond crypto. The Multilateral Sanctions Monitoring Team, which 11 countries run to fill the void left by the disbanded UN panel of experts on North Korea, found that crypto heists provided "approximately one-third of the DPRK's total foreign currency revenue in 2024", that cyber theft helps fund its weapons of mass destruction and ballistic missile programmes, and that the regime "relied heavily on over-the-counter traders in China" to cash out. The UN panel's final report, in March 2024, was investigating 58 suspected attacks worth about $3bn.

Freezes cap the damage but cannot undo it. The $2.85bn frozen or intercepted is 45% of the Binance theft, by Le Détroit's calculation, against about 3% for Bybit, Decrypt noted, largely because more of this haul was in dollar tokens whose issuers can freeze them, as Le Détroit's analysis of 30 October showed. The rest is moving: the FBI expects it to be laundered "using DeFi and instant swap services", and Decrypt reported about 12,000 laundering wallets by 2 November, a new one about every 25 seconds.

8. Le Détroit's reading

The Binance report confirms the thesis with one correction: people are crypto's costliest door, not its only one, since code bugs still cause more thefts and flaws in third-party security software cost Bitget $387.5m in September. But the largest losses since 2022 came through engineers and suppliers' staff, and monthly drills did not stop an attacker willing to spend five months, stage a fake HR persona who shared a social media account of personal photos and videos and wait for one engineer to run one file on one work computer. What can fix it is architecture that assumes someone will: job hunting and take-home tests kept off work machines, no standing deployment tokens on laptops, internal AI tools scoped to the minimum, signing services that check each transaction against policy instead of trusting whoever calls them, and an alarm the moment a hot wallet delegates itself to a contract. That friction costs engineers time and exchanges speed; not paying it cost Binance's balance sheet billions this time, and its users nothing, Binance says, while the proceeds, if the FBI is right, went to a regime under UN sanctions.

Three signals will show whether the industry draws that lesson. First, the scope and findings of the independent review Binance has commissioned, and whether it treats the internal AI tool's permissions and the signing policy as root causes. Second, US action beyond attribution, such as Treasury sanctions on laundering networks or forfeiture cases against the stolen coins. Third, whether regulators, from Abu Dhabi's Financial Services Regulatory Authority, which said on 30 October that it was "engaging closely with Binance and monitoring the incident", to EU supervisors applying DORA, start asking exchanges how staff devices, deployment credentials and internal AI tools are kept away from the signing path, and whether other firms disclose that the same people came knocking.