Binance says fake job interviews and compromised AI tool were used in record $6.3bn crypto hack

Hackers who stole a record $6.3bn (£4.7bn) from Binance used fake job interviews and a compromised internal AI tool, the company has revealed. Initial findings published by the firm, which operates the world's largest cryptocurrency exchange, said the attackers gained access to its systems through a "sophisticated, multi-stage campaign", using techniques including malicious software downloads to compromise the computers of Binance engineers and take control of tools used to drain its wallet of billions of dollars worth of crypto. In a post on X, Binance said hackers targeted its engineers using social engineering techniques, in which attackers use approaches such as phishing to trick people into parting with sensitive or personal details. As part of the hack, one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives. The company said the perpetrators used "more advanced and deceptive" methods to build trust with the engineer, such as sharing social media accounts that contained personal images. During a second interview, he was instructed to download malware masquerading as an "assignment", which deployed malicious code using "obfuscation techniques" to evade detection. Binance said the hackers then leveraged the engineer's compromised computer, along with a compromised internal AI tool, in October to gain control over two other engineers' laptops and execute the next steps of the attack. The incident led Binance to suspend withdrawals for customers globally, meaning users could not get their cryptocurrency out of the platform until the service was restored on Sunday. Customers withdrew billions of dollars worth of assets after it reopened. The company called it a "serious and highly sophisticated security incident", saying "this should not have happened", and added: "We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry." Binance said it had taken a range of steps following the incident, including working with law enforcement to trace and freeze affected assets. It said it had set aside more than 100% of the funds needed to cover the loss, noting that 98% of the token assets impacted had been "replenished" as of Saturday. The record attack is thought to be the largest crypto hack to date. US crime agencies, including the Federal Bureau of Investigation (FBI) and Secret Service, have been assisting Binance in tracing the crypto taken from the platform's own wallets. The agencies, along with a range of cyber analysts, said the hack, like similar breaches before it, bore the signs of having been orchestrated by North Korea. Pyongyang hit back at the claims on Tuesday, denying it was behind the hack. Kim Yo Jong, a top Democratic People's Republic of Korea official and the sister of leader Kim Jong Un, said the accusations were another "sinister attempt" by the US to damage North Korea's public image. The country has consistently denied being behind a number of major cyber attacks it has been blamed for in recent years. The TraderTraitor unit, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025. Binance had previously not responded to the BBC's queries about North Korea's alleged involvement in the hack, but wrote on X on Tuesday: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident." As part of its security efforts following the attack, Binance said it would increase investment in AI tools that can detect security threats and engage third-party cyber experts to carry out a full-scale review of the incident. It also said it would seek to establish a security research fund and work with leading AI and security firms on targeted initiatives.