Binance says fake recruitment process helped hackers steal $6.3bn in crypto

Binance has disclosed that a fake recruitment campaign, malware and a compromised internal artificial-intelligence tool were used in the theft of $6.34bn in cryptocurrency from its wallets. The exchange described the incident as a serious and highly sophisticated security breach, while the FBI has attributed it to North Korea, an allegation Pyongyang denies. According to details released by Binance and reported by The Guardian and BBC News, the operation began in June, when an engineer inadvertently downloaded malware.

The compromise exposed information about the employee and colleagues involved in Binance’s cryptocurrency-wallet infrastructure. The attackers later approached another engineer through a legitimate job-hunting platform. A fake project director arranged a first video interview with a sham human-resources representative, followed by a second interview on a chat application with the supposed chief executive of a fictitious company.

During that second interview, the engineer was instructed to download malware disguised as an assignment. BBC News said the attackers used deceptive methods to establish trust, including social-media accounts containing personal images. Binance said the malicious code used obfuscation techniques intended to avoid detection.

The company said the attackers subsequently used the compromised computer and an internal AI tool to gain control of the systems of two engineers. The Guardian reported that this stage took place on 20 October. On 29 October, the attacker used the second developer’s computer and credentials stolen from the first engineer to execute a malicious script and launch the wallet attack.

Binance said $6.34bn was drained from its cryptowallets. The Guardian reported that $2.85bn had been frozen or intercepted. BBC News said the exchange had replenished 98% of the affected token assets by Saturday and had set aside more than 100% of the funds required to cover the loss.

The breach also disrupted customers. Binance suspended withdrawals globally until service was restored on Sunday, after which customers withdrew billions of dollars in assets, according to BBC News. The company apologised for the concern, disruption and uncertainty caused to users, partners and the wider industry.

The FBI and the US Secret Service have been helping trace the stolen cryptocurrency. The FBI said North Korea was responsible, and Binance later cited the agency’s latest information in its own statement. The Guardian said the FBI’s assessment was supported by US crime agencies and cyber analysts, who saw similarities with previous North Korean-linked operations.

North Korea rejected the accusation. Kim Yo-jong, the sister of leader Kim Jong-un and a senior official, called the claim “absurd rhetoric” and a political provocation, according to North Korea’s state news agency, KCNA. Pyongyang has also denied responsibility for other major cyberattacks attributed to it.

Binance said it would increase investment in AI security tools, bring in outside cyber experts for a full review, establish a security research fund and work with AI and security companies. The precise chain of responsibility remains disputed: the technical account comes from Binance, the attribution from US authorities, and the denial from North Korean officials.