Binance, the world's largest cryptocurrency exchange, has disclosed that hackers used fake job interviews and a compromised internal AI tool to steal a record $6.3bn from the company. According to initial findings, hackers gained access to Binance's systems through a "sophisticated, multi-stage campaign" that involved malicious software downloads to compromise the computers of Binance engineers. This allowed them to gain control over tools to drain the company's wallet of billions of dollars worth of crypto.
The hackers targeted Binance engineers using social engineering techniques, including phishing, to trick them into parting with sensitive or personal details. One engineer was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives. The perpetrators used advanced methods to build trust with the engineer, sharing social media accounts with personal images. The engineer was then instructed to download malware masquerading as an "assignment" during a second interview, which deployed malicious code with obfuscation techniques evading detection.
Binance said the compromised computer and internal AI tool were used to gain control over two other engineers' laptops and execute the next steps of the attack. The incident led the firm to suspend withdrawals for customers globally, meaning users could not access their cryptocurrency until the service was restored on Sunday. Customers withdrew billions of dollars worth of assets after it reopened. Binance apologized for the concern, disruption, and uncertainty caused to users, partners, and the wider industry.
The company has taken steps following the incident, including working with law enforcement to trace and freeze affected assets. Binance has set aside more than 100% of the funds needed to cover the loss and replenished 98% of the token assets impacted as of Saturday. US crime agencies, including the FBI and Secret Service, have been assisting Binance in tracing the crypto taken from the platform's own wallets. The agencies believe the hack bears the signs of having been orchestrated by North Korea.
North Korea has denied being behind the hack, with Kim Yo Jong, a top official and sister of leader Kim Jong Un, calling the accusations a "sinister attempt" to damage the country's public image. The country has consistently denied being behind major cyber-attacks it has been blamed for in recent years. The TraderTraitor unit, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.
Binance has confirmed that the FBI's latest information indicates that the Democratic People's Republic of Korea is responsible for the incident. As part of its security efforts, Binance will increase investment in AI tools to detect security threats and engage third-party cyber experts to carry out a full-scale review of the incident. The company will also seek to establish a security research fund and work with leading AI and security firms on targeted initiatives.
The incident is thought to be the largest crypto hack to date. Binance has assured users that it is taking steps to prevent similar incidents in the future. The company's efforts to enhance its security measures are ongoing, and it will continue to work with law enforcement and cyber experts to protect its users and assets.
Key points
- Hackers used fake job interviews and a compromised AI tool to steal $6.3bn from Binance.
- North Korea has denied being behind the hack, despite US crime agencies believing it bears the signs of having been orchestrated by the country.
- Binance has taken steps to enhance its security measures, including increasing investment in AI tools and engaging third-party cyber experts.
