Following Binance’s recent security incident, co-CEO Richard Teng outlined how the exchange responded to an attack that he said took several months to prepare and execute. He said Binance assumed the financial consequences, replenished 98% of the affected tokens and strengthened its systems to protect users.

In an interview with Fox Business, Teng described the incident as a sophisticated, multi-stage campaign that the U.S. Federal Bureau of Investigation linked to North Korea. He said the attackers used fake job interviews during recruitment, malware disguised as developer tools and artificial intelligence technologies to gain access to Binance’s infrastructure.

“First and foremost, this should not have happened, and we apologize to our users for the inconvenience caused,” Teng said.

Teng said the breach did not result from a single mistake or an accidental click on a malicious link. Instead, the attackers spent months preparing to penetrate the company’s internal infrastructure.

Asset recovery and withdrawals

After identifying the incident, Binance closed all known entry points used by the attackers, rebuilt the compromised systems and published a detailed report on the attack. The company also strengthened its monitoring systems and continued cooperating with law enforcement.

Teng said Binance took responsibility for the attack’s financial consequences so users would not suffer losses. The company set aside more than 100% of the amount needed to restore the affected assets and, by the time of the interview, had replenished 98% of the relevant reserves.

The remaining 2% consists of less liquid tokens that Binance is purchasing gradually through over-the-counter deals to avoid sharply affecting market prices, he said.

“We have replenished 98% of the affected tokens. As for the remaining 2%, since they are less liquid tokens, we are buying them gradually so that it does not affect normal market operations,” Teng explained.

Teng said users can check the exchange’s reserve status through its Proof of Reserves system.

During a CNBC interview, a journalist compared the incident with the FTX crisis and the cryptocurrency industry’s previous promises to improve transparency and protect funds. Teng said the cases were fundamentally different: FTX involved fraud and missing client funds, while Binance temporarily suspended certain operations to verify the security of its infrastructure.

Binance restored withdrawals in stages, beginning on the Sunday after the incident. Teng said the exchange initially recorded increased withdrawal demand, but net inflows and outflows later returned to normal levels. Withdrawal operations for various tokens have also effectively normalized, he said.

Security measures and AI-enabled threats

Binance said it closed all identified entry points, rebuilt or replaced compromised systems and tightened controls over devices with access to internal infrastructure. It also improved risk-management mechanisms for wallet services and expanded AI-based systems designed to detect anomalous activity.

The company said it detected and prevented 57 other suspicious cyberthreats linked to North Korea during 2026.

Teng said artificial intelligence is changing the nature of cyberthreats facing the cryptocurrency industry by shortening the time attackers need to prepare and execute operations while increasing their sophistication.

Binance said the industry had moved from roughly one attack a month to weekly incidents and later recorded cases in which four exchanges were attacked in a single day. The company said security systems must use AI to operate at speeds comparable to attackers’ AI tools.

Teng said substantial security spending cannot eliminate cyberattack risks entirely.

“We spend huge amounts on security every year. So if something like this could happen to us, it can happen to anyone,” he said.

Binance also continues to work with law enforcement agencies, digital-asset issuers and blockchain analytics companies. The company said that coordination had enabled participants to freeze or intercept about $2.85 billion.

According to Binance, rapid coordination across the cryptocurrency ecosystem allows participants to respond to movements of stolen assets faster than traditional financial infrastructure. Teng said the company would continue investing in cybersecurity, improving internal processes and incorporating findings from the investigation, with protecting user assets and maintaining stable platform operations as its top priorities.

Source: Incrypted