Binance says fake job interviews and compromised AI tool were used in record $6.3bn hack

Binance has revealed that the hackers behind a record $6.3bn (£4.7bn) theft from its platform used fake job interviews and a compromised internal AI tool to breach its systems. The company, which operates the world's largest cryptocurrency exchange, described the breach as a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened". According to initial findings published by the firm, the attackers carried out a "sophisticated, multi-stage campaign" that combined social engineering with malicious software downloads to compromise the computers of Binance engineers and gain control over tools used to drain its wallet of crypto worth billions of dollars. Binance said one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives. The perpetrators used what the company called "more advanced and deceptive" methods to build trust with him, including sharing social media accounts that contained personal images. During a second interview, the engineer was instructed to download malware masquerading as an "assignment". Binance said the malicious code was deployed with obfuscation techniques that helped it evade detection. The hackers then leveraged the engineer's compromised computer, along with a compromised internal AI tool, in October to gain control over two other engineers' laptops and execute the next steps of the attack. The incident led Binance to suspend withdrawals for customers globally, meaning users could not remove cryptocurrency from the platform until the service was restored on Sunday. Customers withdrew billions of dollars worth of assets once it reopened. "We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company said. Binance said it had taken a range of steps following the incident, including working with law enforcement to trace and freeze affected assets. It added that it had set aside more than 100% of the funds needed to cover the loss, and that 98% of the token assets impacted had been "replenished" as of Saturday. The attack is thought to be the largest crypto hack to date. US agencies including the Federal Bureau of Investigation (FBI) and the Secret Service have been assisting Binance in tracing the funds taken from the platform's own wallets, and the agencies, along with cyber analysts, said the hack bore signs of having been orchestrated by North Korea. Pyongyang denied the claims on Tuesday, with Kim Yo Jong, a senior Democratic People's Republic of Korea official and sister of leader Kim Jong Un, calling the accusations another "sinister attempt" by the US to damage her country's public image. Binance had previously not responded to queries about North Korea's alleged involvement, but said in its post on X: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident." The TraderTraitor unit, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025. As part of its security response, Binance said it would increase investment in AI tools capable of detecting security threats, engage third-party cyber experts to carry out a full-scale review of the incident, establish a security research fund, and work with leading AI and security firms on targeted initiatives.