Binance co-CEO Teng claims hackers used fake job interviews to steal $6.3 billion in crypto.

Binance said hackers used fake job interviews, malware and compromised internal AI tools to infiltrate its wallet infrastructure, leading to the record-breaking October 29 cyberattack that resulted in the theft of more than $6 billion in assets from the world’s largest crypto exchange.

The attackers “spent months hacking their way out,” Binance co-CEO Richard Teng told CNBC’s “Squawk on the Street” on Tuesday, dismissing suggestions that there was a single point of failure via an employee’s laptop.

“In June, (the attackers) set up a fake version of a development tool and tricked one of our engineers into installing it,” he added. “In September, they posed as recruiters and conducted a series of job interviews with another engineer, and it resulted in a coding exercise containing hidden malware designed to evade security… from there, they violently breached our internal AI tools and gained access that breached the system that authorized our wallet transaction.”

He also said Binance had replenished 98% of the $6.34 billion in affected assets and was still in the process of purchasing outstanding and more illiquid assets.

Teng himself did not attribute the attack to North Korea, but acknowledged that the FBI linked it to North Korean hackers linked to the TraderTraitor group.

June preparations

Preparations for the attack began in June, when a Binance Wallet DevOps engineer downloaded a spoofed Homebrew install “to install a popular AI coding tool after searching for it on a search engine,” according to a security report released by Binance on Tuesday. It said it detected the suspicious activity, replaced the engineer’s device and changed the credentials as a precaution, but that by that time “the role of the employee and his associated colleagues in our wallet infrastructure team had been exposed to the hacker.”

As Binance works to recover from the incident, it has temporarily restricted some withdrawals, pledged to cover all customer losses, and tapped its own reserves to replenish affected assets. Binance and its industry partners, including Tether, Circle and Ripple have reportedly frozen around $3 billion in assets, although some stolen funds continue to flow through laundered channels. Coinbase blocked transfers to compromised wallets and offered direct support to Binance.

Although the incident represents a significant security breach, Binance maintains that it remains financially strong and is focused on identifying the vulnerability, recovering remaining funds, and preventing another attack.

The hack dealt a heavy but short-lived blow to trust in crypto markets, especially compared to previous failures by major exchanges. Investors are now watching whether Binance can fully restore trust in centralized exchanges.

Since Tuesday, Binance has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, decommissioned credentials and tokens associated with affected engineers, and expanded security scans on employee devices, Teng told “Squawk on the Street.”

“We are also bringing in an independent expert to review everything we have done, and we will continue to strengthen our defenses as the investigation continues,” Teng said. “We are working around the clock with law enforcement and industry partners to track down and freeze stolen funds for this front.”