Binance confirmed that a fake job interview and compromised AI tool were used in the $6.3bn crypto theft.
BINANCE HACK: FAKE JOB INTERVIEWS ENABLE $6.3BN THEFT
*Hackers used a bogus recruitment process and a compromised AI tool to steal a record $6.3bn from the world’s largest crypto exchange. The breach forced a global withdrawal freeze and sparked accusations of North Korean involvement.*
Binance disclosed a record $6.3bn (£4.7bn) theft, the largest crypto hack to date. Hackers executed a sophisticated, multi‑stage campaign that began with a bogus job interview on a legitimate platform, targeting a Binance engineer. The engineer was lured into a second interview and asked to download an "assignment" that was actually obfuscated malware. The code hijacked his computer, a compromised internal AI tool, and later gave the attackers control of two more engineers' laptops, allowing them to drain Binance's wallets. In response, Binance halted global withdrawals, reopened on Sunday, and has since replenished 98% of the stolen token assets. The firm set aside more than 100% of the loss and is working with the FBI, Secret Service and third‑party cyber experts to trace and freeze the crypto.
How the fake interview breached Binance's defenses
Binance says a hacker posed as a recruiter on a legitimate job‑hunting platform and invited an engineer to a series of interviews. During the second interview the engineer was asked to download an "assignment" that was actually malicious software. The malware employed obfuscation techniques that evaded detection, giving the attacker control of the engineer's workstation. From that foothold the hackers leveraged a compromised internal AI tool in October to seize two additional engineers' laptops. The multi‑stage campaign then allowed them to command Binance's wallet and drain billions of dollars in crypto.
Is North Korea behind the Binance breach?
US law‑enforcement agencies, including the FBI and Secret Service, are assisting Binance in tracing the stolen assets. Both agencies have said the attack bears the hallmarks of North Korean state‑backed actors. Binance cited the FBI's latest information indicating the Democratic People’s Republic of Korea is responsible. Pyongyang denied involvement; Kim Yo Jong called the accusations a "sinister attempt" by the United States to damage North Korea's image. The Lazarus Group, also known as TraderTraitor, was previously blamed for a $1.5bn Bybit hack in 2025, reinforcing the North Korean link in analysts' eyes.
What remediation steps has Binance taken?
Immediately after the breach Binance suspended withdrawals worldwide, preventing further outflows. The platform reopened on Sunday, after which customers withdrew billions of dollars worth of assets. Binance apologised, saying the incident "should not have happened" and labelled it a "serious and highly sophisticated security incident." The exchange set aside more than 100% of the funds needed to cover the loss and reported that 98% of the token assets impacted had been replenished as of Saturday. It is now working with law‑enforcement to freeze the crypto, increasing investment in AI threat‑detection tools, hiring third‑party cyber experts for a full review, and establishing a security research fund.
What does the hack signal for crypto security?
The Binance breach shows that social engineering can bypass even the most advanced technical safeguards. By turning a legitimate recruitment channel into a weapon, attackers demonstrated that human trust remains the weakest link. The use of a compromised internal AI tool highlights the emerging risk of AI‑driven attack vectors in high‑value financial systems. Binance's response—massive financial reserves, AI upgrades, and external audits—may become the new baseline for exchanges facing state‑backed cyber threats. Regulators and industry players will likely demand stricter verification protocols and continuous AI monitoring to prevent similar multi‑stage assaults.
Frequently asked questions
How did the hackers gain access to Binance's systems?
They lured an engineer through a legitimate job‑hunting platform, used a fake interview to deliver malware disguised as an assignment, and then exploited a compromised internal AI tool to control additional engineers' laptops.
Is North Korea confirmed to be behind the Binance hack?
The FBI indicated that the Democratic People’s Republic of Korea is responsible, but North Korea denied involvement, calling the accusations a "sinister attempt" by the United States.
What steps has Binance taken after the breach?
Binance suspended global withdrawals, set aside more than 100% of the loss, replenished 98% of the affected token assets, is working with law‑enforcement to trace the crypto, and is increasing AI security tools while hiring third‑party cyber experts.
The breach underscores that even the world’s biggest crypto exchange can be undone by a single engineered conversation. As Binance pours resources into AI defenses and external audits, the industry faces a stark reminder: human deception remains the most potent entry point. Future attacks will likely blend social engineering with AI exploitation, forcing regulators and firms to rethink security beyond code and into the psychology of trust.
Sources: BBC World News article "Binance says fake job interviews used as part of $6.3bn crypto hack"