Binance says a fake job interview and a tampered installer led to its $6.34 billion theft, as North Korea rejects the blame

Binance published its first incident report on November 3 on the October 29 theft of about $6.34 billion in digital assets. The exchange says the attack was "not a single isolated breach or a simple phishing incident." Instead, the attackers combined fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced method for authorizing transactions. According to the report, the campaign began in June. A Wallet DevOps engineer searching for a popular AI coding tool installed a tampered version of Homebrew. Binance's security team caught it, replaced his device and reset his credentials. In September, someone posing as a project director at a fictitious company contacted a software engineer through a legitimate job-hunting platform. Two interviews followed, one with a fake HR representative and one with a fake CEO. In all, three engineers' computers were compromised before the attackers reached Binance's wallet signing systems. SecurityWeek reports that about $2.85 billion has been frozen or intercepted. Binance has promised to cover user losses and began restoring withdrawals in phases on November 1. "This should not have happened," the company said. The FBI has blamed TraderTraitor, a North Korean state-backed group. On Wednesday, Kim Yo Jong disputed that finding, calling it "an extension of Washington's invariable hostile policy" toward Pyongyang, and said North Korea saw no need to resume diplomacy. South Korea's military later reported several missile launches toward the sea.