Attackers posed as a fake company to interview a Binance engineer and had the employee download a coding assignment containing malware onto a work computer, the exchange disclosed in an incident report on Tuesday. The hackers then used stolen credentials and hijacked an internal AI tool to compromise additional engineer accounts and gain unauthorized access to Binance’s internal wallet signing service, pushing transactions outside normal withdrawal controls to drain $6.34 billion from hot wallets.
Binance said about $2.85 billion of the stolen assets have now been frozen or intercepted and 98% of affected tokens have been replenished, up from 95% earlier in the day. Founder Changpeng Zhao and co-CEO Richard Teng said the exchange covered 100% of the losses from its own balance sheet and SAFU emergency reserve without borrowing, selling assets or raising capital. After reopening withdrawals in phases starting Sunday, Binance saw $3.64 billion in initial net outflows, or 2.1% of its $171 billion in holdings, before flows stabilized and flipped to net hourly inflows on Tuesday as the exchange restored withdrawals for dozens more tokens on Ethereum and Solana.




