Binance co-CEO Richard Teng said hackers used fake job interviews, a malicious software lure and compromised internal AI tools to breach the exchange's wallet infrastructure. He made the remarks in an interview with CNBC's "Squawk on the Street" on Tuesday.
The attack occurred on Oct. 29 and led to more than $6 billion in assets being stolen, according to the source. Teng told CNBC the attackers "spent months building their way in," and rejected suggestions that a single employee's laptop was the sole point of failure.
Teng described the sequence. In June, attackers set up a fake version of a developer tool and lured an engineer to install it. In September, they posed as recruiters and ran job interviews with another engineer, which led to a coding exercise containing hidden malware. Teng said the attackers then moved through internal AI tools to gain access to the system that authorized wallet transactions.
A Binance security report published Tuesday said the preparations began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for an AI coding tool. The report said Binance detected the activity, replaced the engineer's device and rotated credentials, but that the engineer's role and those of colleagues on the wallet infrastructure team had already been exposed.
Teng said Binance has replenished 98% of the $6.34 billion in affected assets and is still buying back more illiquid holdings. Binance and industry partners including Tether, Circle and Ripple have reportedly frozen about $3 billion in assets, though the source notes some stolen funds continue to move through laundered channels.
Teng did not attribute the attack to North Korea. He acknowledged that the FBI has linked it to North Korean hackers tied to the TraderTraitor group.
Teng said Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned affected credentials and tokens, and expanded security scans across employee devices. He said Binance is bringing in an independent expert to review its response.