Binance published a postmortem detailing a large-scale cyberattack attributed to a North Korea-linked unit. The investigation describes a multi-month sequence beginning with a tampered installer downloaded by a developer in June, spread via a malicious Google ad. In September, a second engineer was targeted through fake recruitment efforts, leading to a series of calls, social media verification, and a malware-laced interview assignment. The company says the first malware installation was detected, and the device was replaced, but the second attack evaded detection and replaced a pyenv executable with a backdoor. The malware used obfuscation to evade security tools and altered a legitimate tool to execute commands and contact an attacker-controlled server. By October 20, attackers leveraged Binance’s internal AI tool to gain control over wallets of the first compromised engineer and a second employee, then on October 29 used stolen credentials from the first engineer to trigger the attack on a third account. Binance notes that roughly $2.85 billion of the stolen assets had been frozen or intercepted, with 98% of impacted tokens replenished at the time of reporting. The firm says withdrawals had resumed broadly and that it has rebuilt affected systems, replaced devices, and enhanced security with AI-powered anomaly detection. Binance said it would absorb the financial losses and has replenished most assets, while pursuing the remaining illiquid assets. The company also emphasizes that the incident underscores risks from social engineering in job-interview contexts and from internal tools.