By Ahmed Abdelsalam
The world's largest cryptocurrency exchange, Binance, has disclosed a sophisticated hacking operation that resulted in the theft of approximately $6.3 billion in digital assets on October 29. The FBI has attributed the attack to a North Korean hacking group, a claim Pyongyang has denied.
Attack Began With Tampered AI Tool
According to an initial report published by Binance, the breach originated in June when a wallet developer downloaded an AI coding tool that had been secretly modified. The compromise was detected, the device replaced, and credentials changed, but the attacker retained visibility into the wallet team's operations.
Fake Job Interview Compromised Second Engineer
In September, a second software engineer was targeted through a fictitious job interview process that included a virtual meeting with a supposed CEO. The engineer downloaded a malicious code repository, giving the attacker further access.
Internal AI Tool Used to Seize Wallet Controls
On October 20, the attacker leveraged the compromised computer alongside an internal AI tool to take control of two wallet developers' systems. Nine days later, stolen credentials from the first developer were used to trigger a malicious script that executed the massive withdrawal.
Binance Apologizes and Boosts Security Investment
"This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in its report. The exchange confirmed it is repaying all affected customers and is increasing investment in AI-enabled detection, establishing a security research fund, and collaborating with leading AI companies to prevent future breaches.
