Binance has revealed that hackers used fake job interviews, malicious software and a compromised internal artificial intelligence tool in a sophisticated cyberattack that resulted in the theft of cryptocurrency valued at a record $6.3 billion (£4.7 billion). The company, which operates the world’s largest cryptocurrency exchange, said its initial investigation identified a multi-stage campaign targeting its engineers and internal systems. According to Binance, attackers used several techniques to compromise engineers’ computers before gaining access to tools that enabled them to drain billions of dollars worth of cryptocurrency from the platform’s wallets. The company described the incident as a serious security breach and apologized to customers, partners and the wider cryptocurrency industry. In a statement shared on X, Binance explained that the attackers relied on social engineering to build trust with employees and gain access to company systems. One engineer was reportedly approached through a legitimate job-hunting platform and invited to participate in recruitment interviews with fake company representatives. The attackers allegedly used convincing communication and social media accounts containing personal photographs to establish credibility and make the interaction appear genuine.
Binance said the targeted engineer was instructed to download a file presented as an assignment during a second interview. The file contained malware disguised as a legitimate work task and deployed malicious code using obfuscation techniques designed to make detection more difficult. After compromising the engineer’s computer, the attackers reportedly used it to access additional internal resources. Binance stated that hackers then leveraged the compromised device and an internal AI tool to gain control over the laptops of two other engineers and carry out further stages of the operation. The incident forced Binance to suspend customer withdrawals globally, preventing users from transferring their cryptocurrency until services were restored on Sunday. After withdrawals resumed, customers moved billions of dollars worth of assets from the exchange. Binance apologized for the concern and uncertainty caused by the disruption and said it had worked with law enforcement agencies to trace and freeze affected assets. The company also stated that it had set aside more than 100 percent of the funds required to cover the loss, while 98 percent of the affected token assets had been replenished as of Saturday.
Investigations have also focused on possible North Korean involvement in the attack. US agencies, including the Federal Bureau of Investigation and the Secret Service, have been assisting Binance in tracing the stolen cryptocurrency. These agencies and several cybersecurity analysts have indicated that the attack bears characteristics associated with cyber operations previously attributed to North Korea. Binance subsequently stated that the latest information released by the FBI identified the Democratic People’s Republic of Korea as responsible for the incident. North Korea has denied the allegations. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, rejected the accusations, describing them as an attempt by the United States to damage the country’s international reputation. Pyongyang has repeatedly denied responsibility for major cyber incidents attributed to it by governments and security researchers. The TraderTraitor unit, also known as the Lazarus Group, has previously been linked to cryptocurrency thefts, including the 2025 attack on exchange Bybit that resulted in the loss of approximately $1.5 billion. The group has been associated with several high-value cryptocurrency operations, placing the latest allegations within broader international concerns about cybercrime targeting digital asset platforms.
Following the breach, Binance said it would expand its cybersecurity investment and introduce additional measures to strengthen the protection of its systems and customers. The company plans to increase investment in AI-powered security tools designed to identify suspicious activity and detect emerging threats. It also intends to involve independent cybersecurity specialists in a comprehensive review of the incident to examine how attackers gained access and what improvements are needed to prevent similar breaches. Binance further announced plans to establish a security research fund and collaborate with leading artificial intelligence and cybersecurity companies on targeted initiatives. The incident highlights the importance of protecting employee devices, securing internal applications and carefully managing access to tools connected to corporate infrastructure. It also demonstrates how attackers can combine social engineering, malware and compromised workplace technologies to move beyond an initial breach. For cryptocurrency exchanges and other digital asset platforms, the consequences can extend beyond financial losses to include service disruptions, customer withdrawals and concerns about platform security. The use of fake recruitment processes as an entry point also underlines the need for employees to verify interview requests, avoid downloading untrusted files and follow security procedures when handling unfamiliar assignments. As Binance continues working with investigators and reviewing its security arrangements, the incident reinforces the need for continuous monitoring, employee awareness and stronger safeguards across systems that handle valuable digital assets.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
