Binance Hackers Used Fake Job Interview to Infiltrate Before $6.3B Attack

Binance said Tuesday that hackers used a fabricated recruitment process to compromise an engineer’s computer, then exploited an internal AI tool to penetrate its systems before stealing $6.3 billion in cryptocurrency.

The exchange’s initial account describes successive breaches over several months that culminated in the October 29 theft. The attack could rank as the largest financial heist on record.

A Fictitious Employer

A software engineer looking for another job downloaded a malicious code repository in September during what appeared to be a legitimate hiring process.

The deception included a virtual interview with someone posing as the fictitious company’s chief executive.

The computer compromised through that process subsequently became a route into the wallet team’s systems, according to Binance.

On October 20, the attacker combined access to that machine with an internal AI tool to take control of two wallet developers’ systems.

Nine days later, the hacker executed a malicious script from the second wallet developer’s computer, using credentials stolen from the first.

That triggered the theft from the company’s wallets.

An Earlier Breach

The recruitment scheme followed a separate intrusion in June, when a wallet team employee downloaded a tampered AI coding tool advertised to developers.

Binance detected that compromise, replaced the employee’s device and changed credentials.

However, the incident had exposed the employee’s role and those of colleagues on the wallet team to the attacker.

“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.

Repayments and Security Spending

The FBI has attributed the theft to a North Korean hacking group. North Korea has rejected the allegation.

Binance, the world’s largest cryptocurrency exchange, says it is repaying every customer who lost funds in the attack.

The company also plans to increase spending on AI-enabled detection.

It is working to establish a security research fund and develop targeted initiatives with leading AI companies.