By Islam El-Sakka
Binance has disclosed that hackers who stole a record $6.3bn from the world's largest cryptocurrency exchange used fake job interviews and a compromised internal AI tool to breach its systems. The company described the breach as a "serious and highly sophisticated security incident" and apologised to users.
Attack details
Hackers targeted Binance engineers through social engineering on a legitimate job-hunting platform, inviting one engineer to bogus interviews with fake company representatives. They built trust by sharing personal images on social media, then instructed the engineer to download malware disguised as an assignment during a second interview. The malicious code used obfuscation techniques to evade detection, compromising the engineer's computer and an internal AI tool in October. This access allowed the attackers to control two other engineers' laptops and execute the next stages of the attack.
Impact and response
The incident forced Binance to suspend withdrawals globally until service was restored on Sunday. Customers withdrew billions of dollars worth of assets after the platform reopened. Binance said it has set aside more than 100% of the funds needed to cover the loss, with 98% of affected token assets replenished as of Saturday. The company is working with law enforcement to trace and freeze stolen assets.
North Korea link
US agencies including the FBI and Secret Service have assisted in tracing the stolen cryptocurrency. Cyber analysts and the FBI attribute the hack to North Korea's Lazarus Group, also known as TraderTraitor, which was blamed for a $1.5bn hack of Bybit in 2025. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, denied the allegations on Tuesday, calling them a "sinister attempt" to damage the country's image. Binance confirmed on Tuesday that the latest FBI information indicates the Democratic People's Republic of Korea is responsible.
Security measures
In response, Binance said it will increase investment in AI tools that detect security threats, engage third-party cyber experts for a full-scale review, establish a security research fund, and collaborate with leading AI and security firms on targeted initiatives.
