Fake Job Interviews and AI Exploit: How Hackers Stole a Record $6.3 Billion From Binance

Hackers behind the record $6.3 billion (£4.7 billion) theft from cryptocurrency exchange Binance gained access through fake job interviews and a compromised internal AI tool, according to the company.

In preliminary findings, Binance described the breach as a "sophisticated, multi-stage campaign" that targeted engineers using social engineering tactics. Attackers reportedly posed as recruiters on a legitimate job platform and convinced an engineer to participate in fraudulent interviews.

During the process, the engineer was instructed to download what appeared to be a job-related assignment. The file contained malware designed to evade detection, enabling the attackers to compromise the engineer's computer.

Binance said the hackers then used the breached device and an internal AI tool to gain access to two additional engineers' laptops, ultimately securing control of systems used to manage the exchange's wallets. The attack resulted in the theft of billions of dollars' worth of cryptocurrency.

Describing the incident as a "serious and highly sophisticated security breach," Binance apologised and acknowledged that "this should not have happened."

The company temporarily suspended customer withdrawals worldwide while it responded to the attack. Withdrawals resumed on Sunday, after which customers moved billions of dollars' worth of assets off the platform.

Binance said it has since worked with law enforcement agencies to trace and freeze stolen assets. It also stated that it has reserved more than enough funds to cover losses and had replenished 98% of affected token assets as of Saturday.

The breach is believed to be the largest cryptocurrency hack on record.

North Korea Suspected

US authorities, including the FBI and Secret Service, have assisted efforts to trace the stolen funds and said the attack bears the hallmarks of operations previously linked to North Korea.

North Korea has denied any involvement. Kim Yo Jong, sister of leader Kim Jong Un, dismissed the allegations as a US attempt to damage the country's reputation. Pyongyang has consistently rejected responsibility for major cyberattacks attributed to it in recent years.

The Lazarus Group, also known as TraderTraitor, has previously been linked to several high-profile cryptocurrency thefts, including the then-record $1.5 billion hack of exchange Bybit in 2025.

While Binance had initially declined to comment on North Korea's alleged involvement, the company later stated that information released by the FBI indicates that the Democratic People's Republic of Korea was responsible for the attack.

In response to the breach, Binance said it will increase investment in AI-driven threat detection, commission an independent security review, establish a security research fund, and expand collaboration with leading cybersecurity and AI firms.

Source: BBC