Binance says hackers who stole a record $6.3 billion (£4.7 billion) from the exchange used fake job interviews and a compromised internal AI tool to break into its systems.
In initial findings posted on X, the company, which operates the world's largest cryptocurrency exchange, described a "sophisticated, multi-stage campaign". It called the breach a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened"
Binance said the attackers used social engineering, including malicious software downloads, to compromise engineers' computers and gain control of tools used to drain its wallets.
According to the company, one engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives. It said the attackers used "more advanced and deceptive" methods to build his trust, such as sharing social media accounts that contained personal images.
During a second interview, the engineer was told to download what was presented as an "assignment". Binance said it was malware that deployed malicious code using "obfuscation techniques" to avoid detection.
The company said the hackers then used that engineer's computer and a compromised internal AI tool in October to take control of two other engineers' laptops and carry out the next steps of the attack.
Binance suspended withdrawals for customers globally after the incident. Service was restored on Sunday, and customers withdrew billions of dollars worth of assets after it reopened.
The company said it has worked with law enforcement to trace and freeze affected assets. It said it has set aside more than 100 per cent of the funds needed to cover the loss, and that 98 per cent of the affected token assets had been replenished as of Saturday.
The Federal Bureau of Investigation and the Secret Service have been helping Binance trace the stolen crypto. The agencies and cyber analysts have said the hack bore the signs of North Korean involvement, as with earlier breaches.
Binance wrote on Tuesday that the latest FBI information indicates North Korea is responsible. North Korea denied it. Kim Yo Jong, a senior official and the sister of leader Kim Jong Un, called the accusations another "sinister attempt" by the United States to damage her country's public image.
The TraderTraitor unit, also known as the Lazarus Group, was blamed for a $1.5-billion hack of the Bybit exchange in 2025, then a record. North Korea has consistently denied involvement in major cyberattacks it has been blamed for.
Binance said it will increase investment in AI tools that detect security threats and bring in third-party cyber experts for a full-scale review. It also said it will seek to establish a security research fund and work with leading AI and security firms on targeted initiatives.
Comments (0)
Please log in to comment.
No comments yet.