Binance has disclosed that hackers orchestrated a $6.3 billion heist by employing a combination of malicious software, sophisticated recruitment scams, and internal AI tools. The breach, which compromised the world’s largest cryptocurrency exchange, originated in June with an accidental malware download by a staff member. This initial foothold eventually facilitated a large-scale raid last week on the firm’s critical hot wallets. Malicious software and an internal AI tool, the company has revealed, the hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews. The hackers got their first foothold in the summer when a company engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s cryptowallet infrastructure, according to an update Binance released on Tuesday.
According to an internal investigation published by the company, the attackers targeted multiple engineers to gain system access.
In September, a fake project director approached an engineer on a professional hiring platform, eventually maneuvering them into a sham multi-round interview process. During a video call with an individual posing as a fictitious company’s chief executive, the engineer was tricked into executing a malicious file.
The threat actors leveraged this compromised system on October 20 alongside internal AI software to seize control of additional developer accounts. By October 29, the attackers utilized stolen credentials from the initial engineer to launch a final malicious script, successfully siphoning billions from the exchange’s infrastructure. The attacker used the second developer’s computer, using stolen credentials from the first engineer, and triggered a malicious script to launch the attack, then on 29 October.
Binance officials confirmed that $2.85 billion of the stolen $6.34 billion has been successfully intercepted or frozen. The firm issued an apology to its users and partners, acknowledging that the security failure caused significant industry-wide uncertainty and disruption. According to binance, $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted.
The FBI attributed the massive operation to North Korean hackers on Saturday. However, Pyongyang has vehemently rejected these findings. Kim Yo-jong, sister of leader Kim Jong-un, characterized the accusations as “absurd rhetoric” during a statement provided through the state news agency, KCNA.
Kim labeled the allegations as a grave political provocation, arguing that Washington is merely attempting to portray North Korea as a cybercriminal state. She maintained that the U.S. narrative is an unproven, repetitive assertion intended to mislead international public opinion regarding global cybercrime. “The FBI is trying to brand the DPRK [the Democratic People’s Republic of Korea] as a ‘cybercriminal state,’ claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the i.
The incident highlights the evolving nature of digital security threats, specifically the use of deepfake-style social engineering and recruitment fraud, which are tactics historically linked to North Korean cyber operations aimed at funneling revenue back to the regime. But normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang, deepfake job interviews are a known part of North Korea’s cyber-arsenal.
