Binance released on Tuesday a detailed investigation into the $6.3 billion hack of its cryptocurrency platform, showing how attackers used fake job interviews and malicious code to steal the funds.
asserted
attackers → release → funds
The crypto exchange said it had replenished 98 per cent of the affected assets by drawing on its own funds, with the remaining amount involving little-traded currencies that are harder to acquire.
asserted
that → say → currencies
The attack, carried out over about four hours on Oct 29, was attributed by the US Federal Bureau of Investigation (FBI) to North Korea-affiliated hackers.
asserted
attack → carry → hackers
Pyongyang has denied the allegations, with the powerful sister of leader Kim Jong Un calling the claim “absurd rhetoric”.
uncertain
sister → deny → claim
Around $2.85bn of the stolen $6.34bn has been frozen, Binance said, meaning that the attackers could not use it or convert it to another currency.
uncertain
attackers → steal → currency
News of the hacking attack, which is thought to be the biggest ever crypto heist, caused the prices of most major cryptocurrencies to fall sharply.
asserted
prices → think → cryptocurrencies
According to Binance, attackers took their first steps towards the breach as early as June.
uncertain
attackers → accord → June
First, they targeted a platform engineer by getting them to download a virus-laden version of the widely-known programming software Homebrew.
asserted
them → target → software
Binance’s cybersecurity teams identified the malware and removed it, but the hackers had already had time to harvest information about the engineer and his colleagues.
asserted
hackers → identify → engineer
In September, the attackers approached another Binance engineer through a legitimate job-search platform, offering him an interview for a position in a fictitious company.
asserted
attackers → approach → company
After building trust with the subject through the sharing of social media photos and videos, they asked the engineer to download a test exercise as part of the interview process.
asserted
they → build → process
The exercise contained malware that deployed “sophisticated obfuscation and evasion techniques,” Binance said, including replacing a legitimate development tool component with a malicious version.
asserted
Binance → contain → version
That malware was critical to the success of the attack, as it allowed the hackers to establish a connection with Binance’s internal systems.
asserted
hackers → allow → systems
On October 20, the attackers used the access they had gained and an internal AI tool to gain control over software used by two other engineers.
asserted
they → use → engineers
Nine days later, they triggered malicious code that initiated the attack.
asserted
that → trigger → attack
Binance says outflows normalised as North Korea rejects US allegation
Asset outflows from Binance have normalised and the company was in “very strong financial health”, its co-CEO said.
asserted
CEO → say → health
The world’s biggest cryptocurrency exchange, whose customers had withdrawn a net $4.72bn as of Monday after the financial heist, has also launched a campaign to stem outflows and woo new users.
asserted
customers → withdraw → users
But after that … it’s pretty much normalised,” Richard Teng told a Hong Kong Fintech Week event on Tuesday.
asserted
Teng → normalise → Tuesday
“The company is in very strong financial health,” he said.
asserted
he → say → health
“This is something that we can cover.
asserted
we → cover → that
We are able to do so.
asserted
We → do → ?
The crypto exchange was seeing “hourly deposits exceed withdrawals”, Binance said in an X post earlier on Tuesday, adding that it reflected improving user activity and stabilising flows.
asserted
it → see → activity
The Federal Bureau of Investigation (FBI) said on the weekend that North Korea was responsible for the theft of more than $6bn in crypto assets, a crime that sent shockwaves through the industry.
asserted
that → say → industry
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, said the US allegations proved Washington remained hostile towards Pyongyang, according to a report on Tuesday by state news agency KCNA.
uncertain
Washington → say → KCNA
Pyongyang has not responded to US President Donald Trump’s overtures, made earlier this year, to resume summit diplomacy.
asserted
Pyongyang → respond → diplomacy
In the wake of the US allegations, Kim Yo Jong said North Korea had “issues to reconsider” over what she called US hostility.
asserted
she → say → what
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” KCNA quoted Kim Yo Jong as saying.
asserted
KCNA → try → Jong
“But the US assertion is absurd rhetoric and nothing new,” said Kim, a ruling party official.
asserted
Kim → say → ?
“It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds.”
Revenue stream
North Korea faces growing scrutiny over cryptocurrency theft, which analysts say is a key source of funds for its weapons programmes.
Cybersecurity experts say North Korean hackers are among the world’s most prolific crypto thieves and the proceeds help fund the country’s efforts to develop nuclear weapons and ballistic missiles capable of hitting the United States.
North Korea has stolen cryptocurrency worth $7.6bn this year, more than in any previous year, according to estimates by blockchain analytics firm Elliptic.
uncertain
Korea → mislead → Elliptic
North Korea denies allegations linking it to cryptocurrency theft and other cybercrimes.
asserted
Korea → deny → theft
Analysts in Seoul said Pyongyang’s unusually swift response likely reflected concern that the allegation could lead to tighter efforts to disrupt revenue streams that North Korea is accused of using to finance its weapons.
uncertain
Korea → say → weapons
“With sanctions already in place, cryptocurrency theft has become one of North Korea’s key channels for securing funds for regime maintenance and weapons development,” said Lim Eul-chul, a professor at Kyungnam University’s Institute for Far Eastern Studies.
asserted
chul → become → Studies
Additional US measures targeting crypto wallets, laundering networks and cryptocurrency exchanges could choke off an important source of revenue, Lim said.
uncertain
Lim → target → revenue
South Korea’s central bank estimated North Korea’s gross domestic product at 47.18 trillion won ($35.09bn) in 2025, meaning the Binance theft could be equivalent to about a sixth of its economic output.
uncertain
theft → estimate → output
Blockchain analytics firm Chainalysis estimated 89pc of crypto hack losses in 2026 were linked to North Korea, up from 15pc in 2021.
asserted
89pc → estimate → 2021
It said the average reported loss per hack rose from $50.65 million in 2021 to $185.65m in 2026.
“I guess you could call it big game hunting, where they’re targeting these larger exchanges that may take more time and more complexity to be able to do … but the payoff can be relatively large,” said Alec Zebrick, senior manager of Asia-Pacific Global Services at Chainalysis.
uncertain
Zebrick → say → Chainalysis
North Korea is one of the world’s most impoverished countries but has poured resources secured through illicit means and activities banned under UN Security Council resolutions into its missile and nuclear programmes.
asserted
Korea → pour → programmes
Kim Yo Jong said North Korea would “reconsider” unspecified issues in light of the “very unpleasant US hostile attitude”, without elaborating.
asserted
Korea → say → attitude
North Korea has not publicly responded to Trump’s offers to resume summit diplomacy.
asserted
Korea → respond → diplomacy
Binance withdrawals
Binance launched a campaign on Monday offering fee rebates, rewards to eligible users who rack up at least $10,000 in cumulative trading volume, as well as annual percentage rates of up to 10pc on certain yield-generating products.
asserted
who → launch → products
…and 5 more, not listed.
The Aporia
