A trusted engineer answered what looked like an ordinary job approach, and in that quiet opening a company that moves the world's money was turned against itself. Binance, the largest crypto exchange, now faces a record $6.3bn loss, a suspended platform, and the sober question of who stood behind the trick. Washington's investigators point toward North Korea, a charge Pyongyang rejects, while the exchange works to rebuild what was lost and to guard against the next attempt. It is one more chapter in a long contest between digital money and those who want to take it.
Binance Blames Fake Job Interviews and Compromised AI Tool for Record $6.3bn Crypto Hack
It began with a job offer, not a software flaw
Mark
What stands out to me is how the attack began. Not with a software flaw, but with a job offer.
Mimi
Right. An engineer was contacted on a legitimate job-hunting platform, then interviewed by fake company representatives. In a second interview he was told to download an "assignment", and that was the malware.
Mark
And it spread from there?
Mimi
Binance says the hackers used his computer plus a compromised internal AI tool to take over two other engineers' laptops in October.
Luke
Worth noting that this is Binance's own account, and it's labelled initial findings. We don't have an independent reconstruction yet.
Mark
What about the North Korea link?
Mimi
The FBI, the Secret Service and cyber analysts say the hack bears the signs of North Korean orchestration. Binance quoted the FBI's information saying the DPRK is responsible.
Luke
Careful with wording, though. "Bore the signs of" is attribution by agencies and analysts, and Pyongyang flatly denies it through Kim Yo Jong. The source doesn't present public evidence either way.
Mark
And customers? Are they made whole?
Mimi
Binance says it set aside more than 100% of the funds needed and that 98% of affected token assets were replenished as of Saturday. Withdrawals resumed Sunday, and billions were withdrawn.
Luke
Those figures are the company's own claims. And the source doesn't say how the "largest ever" label was determined beyond "thought to be".
O Pulso
- A single engineer was lured by fake interviews on a job platform and handed a disguised assignment that was really malware.
- The intrusion spread across laptops and a compromised internal AI tool, reaching deep enough to drain billions from the exchange's wallets.
- Binance halted global withdrawals, leaving customers locked out until Sunday, and then faced a rush of billions in outflows once trading resumed.
- Binance says it has replenished 98% of affected token assets and set aside more than the full loss while tracing and freezing funds with the FBI and Secret Service.
- US agencies link the breach to North Korea, and Pyongyang calls the accusation a sinister lie, leaving the attribution contested as an independent review begins.
A trusted engineer answered what looked like an ordinary job approach, and in that quiet opening a company that moves the world's money was turned against itself. Binance, the largest crypto exchange, now faces a record $6.3bn loss, a suspended platform, and the sober question of who stood behind the trick. Washington's investigators point toward North Korea, a charge Pyongyang rejects, while the exchange works to rebuild what was lost and to guard against the next attempt. It is one more chapter in a long contest between digital money and those who want to take it.
An engineer at Binance was approached through a legitimate job-hunting platform and invited to interview. The companies and the interviewers were fake. According to the exchange's first findings, that approach was the opening move in the theft of a record $6.3bn in cryptocurrency.
The attackers worked patiently. They shared social media accounts, including personal images, to build trust, and during a second interview they asked the engineer to download an assignment. It was malware, built to avoid detection. From that one laptop, hackers reached two other engineers' machines in October, using a compromised internal AI tool, and then carried out the drain.
The damage reached customers directly. Withdrawals were suspended worldwide until Sunday, and when they reopened, users pulled out billions. Binance apologised for the disruption and said it had set aside funds to cover the loss and replenished 98% of affected token assets as of Saturday.
US agencies say the hack bore the marks of North Korean operators, a claim Pyongyang denies. Binance now says the FBI's latest information points to North Korea. The exchange plans a third-party review and more AI-based threat detection, and the independent findings are the next thing to watch.
An engineer at Binance was approached through a legitimate job-hunting platform and invited to interview for a position. The companies and the people conducting the interviews were fake. According to the exchange's own initial findings, that approach was the opening move in the theft of a record $6.3bn (£4.7bn) in cryptocurrency.
Binance, which runs the world's largest crypto exchange, published its preliminary account of the breach in a post on X. It described a "sophisticated, multi-stage campaign" in which hackers used a range of techniques, including malicious software downloads, to compromise engineers' computers. From there they gained control of the tools needed to drain the company's wallet of billions of dollars in crypto. The company called it a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened."
The method was social engineering, in which attackers use tactics such as phishing to trick people into handing over sensitive or personal details that can then be used to reach their accounts. Binance says the people behind this attack went further than usual to build trust with the engineer, including sharing social media accounts that contained personal images. During a second interview, he was told to download what was presented as an assignment. It was malware, and it carried code with obfuscation techniques designed to evade detection.
The breach did not stop with one laptop. Binance says that in October the hackers used the engineer's compromised computer, together with a compromised internal AI tool, to take control of the laptops of two other engineers, and then carried out the next steps of the attack.
The consequences reached customers directly. Binance suspended withdrawals globally, so users could not take their cryptocurrency off the platform until the service was restored on Sunday. After it reopened, customers withdrew billions of dollars worth of assets. The company apologised for the "concern, disruption and uncertainty" this caused users, partners and the wider industry.
Binance says it is working with law enforcement to trace and freeze affected assets. It says it has set aside more than 100% of the funds needed to cover the loss, and that 98% of the token assets affected had been replenished as of Saturday. The attack is thought to be the largest crypto hack to date.
US agencies, including the FBI and the Secret Service, are helping Binance trace the funds taken from its wallets. Those agencies and a range of cyber analysts have said the hack, like similar breaches before it, bore the signs of North Korean orchestration. Pyongyang denied this on Tuesday. Kim Yo Jong, a senior official and the sister of leader Kim Jong Un, called the accusations another "sinister attempt" by the US to damage North Korea's public image. The country has consistently denied responsibility for major cyber attacks it has been blamed for in recent years. The TraderTraitor unit, also known as the Lazarus Group, was blamed for the then-record $1.5bn hack of the exchange Bybit in 2025.
Binance had earlier not answered the BBC's questions about North Korea's alleged role. On Tuesday, though, its X post said the latest FBI information "indicates that the Democratic People's Republic of Korea is responsible for this incident."
Going forward, Binance says it will invest more in AI tools that detect security threats and bring in third-party cyber experts for a full-scale review of the incident. It also plans to seek to establish a security research fund and work with leading AI and security firms on targeted initiatives. Binance's findings are described as initial, so the external review is the next thing to watch.
Citações Notáveis
This should not have happened.— Binance, in its post on X
The accusations are another "sinister attempt" by the US to damage North Korea's public image.— Kim Yo Jong, North Korean official
Quer a matéria completa?
Leia o original em BBC News ↗
Technology