Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto

watch now

Binance said hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure, leading to the record-breaking Oct. 29 cyberattack that resulted in more than $6 billion in assets being stolen from the world's largest crypto exchange.

The attackers "spent months building their way in," Binance co-CEO Richard Teng told CNBC's "Squawk on the Street" Tuesday, rejecting suggestions that there was a single point of failure through one employee's laptop.

"In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that," he added. "In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security ... from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction."

He also said Binance has replenished 98% of $6.34 billion in affected assets, and that it is still in the process of purchasing outstanding, more illiquid assets.

Teng himself did not attributed the attack to North Korea but acknowledged that the FBI has linked it to North Korean hackers tied to the TraderTraitor group.

June preparations

Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation "to install a popular AI coding tool after searching for it on a search engine," according to a security report published by Binance Tuesday. It said it detected the suspicious activity, replaced the engineer's device and rotated credentials as a precaution, but that by then the employee's "role and his related colleagues on our wallet infrastructure team was exposed to the hacker."