Binance explains how hackers stole $6.3bn using fake job interviews and stolen credentials
It all began with one compromised download
Hackers behind a record $6.3bn cryptocurrency heist from the Binance exchange exploited fake job interviews and a compromised internal AI tool to infiltrate its systems, the company has revealed.
The world's largest cryptocurrency exchange said attackers targeted its wallet development team through a series of "sophisticated" social engineering attacks, eventually gaining control of employees' computers and internal systems.
The theft, which took place on 29th October, is believed to be the largest cryptocurrency hack on record.
Binance said it would reimburse customers who lost funds.
Binance has now explained the attack chain, which began in June with an employee downloading a compromised version of a coding tool, in its initial incident report.
The employee, who worked in the exchange's wallet development team, unknowingly installed malicious software that exposed information about the company's internal systems and personnel.
Binance detected the breach, replaced the affected computer and changed the employee's credentials.
However, the attackers had already gained information about the employee's role and other members of the wallet development team.
They subsequently targeted a second software engineer in September.
According to Binance, the engineer was looking for a new job when he downloaded a malicious code repository following what appeared to be a legitimate recruitment process.
The interview process included a virtual meeting with the chief executive of a fictitious company.
The downloaded repository contained malicious code that allowed the attackers to compromise the engineer's computer.
By 20th October, the hackers had combined access to the compromised computer with a vulnerable internal AI tool to gain control of the systems used by two wallet developers.
On 29th October, they used the second developer's computer, together with credentials stolen from the first employee, to execute a malicious script that triggered the theft.
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said.
North Korea accused of orchestrating theft
US authorities, including the FBI and Secret Service, have been helping Binance trace and freeze the stolen cryptocurrency.
Several cybersecurity organisations have linked the attack to North Korea. Cybersecurity firm Check Point and blockchain intelligence company TRM Labs have both attributed the incident to a North Korean hacking operation.
It would not be the first time North Korea has used fake employment claims as part of a scam.
Check Point further identified TraderTraitor, also known as Lazarus, as the culprit behind the attack.
The group has been linked to numerous high-profile cyber incidents, including attacks involving software development platforms PyPI and GitHub.
It was also blamed for the $1.5bn theft from cryptocurrency exchange Bybit in 2025, previously the largest cryptocurrency hack on record.
North Korea rejected the latest accusations on Tuesday. Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior government official, described the allegations as a "sinister attempt" by the US to damage the country's international reputation.
Binance promises to strengthen security
The attack triggered significant withdrawals after Binance reopened its platform, with customers pulling out billions of dollars' worth of digital assets.
The company said 98% of the affected token assets had been replenished by Saturday.
The company added that it was increasing investment in AI-powered security detection to identify suspicious activity and prevent similar incidents.
The exchange plans to establish a dedicated security research fund and introduce targeted initiatives in collaboration with leading AI companies.