Binance Discloses How Hackers Used Fake Job Interviews and AI Tools in $6.3 Billion Cyber Heist

Global cryptocurrency exchange Binance has released detailed findings into the October 29th cyberattack that resulted in the theft of $6.34 billion (£4.7 billion), revealing that the perpetrators spent months targeting engineers with fake job interviews, malicious code, and compromised internal artificial intelligence tools.

In a comprehensive security report published Tuesday, the world's largest digital asset exchange outlined how the multi-stage operation culminated in an unauthorized 20-minute drain of its wallet infrastructure across more than 10 blockchains.

Binance formally apologized for the breach in a statement published to X:

"This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry…It was not a single isolated breach or a simple phishing incident”.

Speaking on CNBC's Squawk on the Street, Binance Co-CEO Richard Teng confirmed the hackers "spent months building their way in", rejecting claims that the breach stemmed from a single point of failure.

According to Binance's timeline, preparations for the heist began in June when a wallet DevOps engineer (Engineer A) searched online for a popular developer utility and inadvertently downloaded a "tampered Homebrew installation". Although security systems detected the anomaly, replaced the device, and rotated credentials, the employee's role and associated colleagues on the wallet infrastructure team were exposed to the perpetrators.

In September, the attackers initiated a social engineering scheme targeting a second software engineer (Engineer B) on a legitimate career platform. Pretending to be company recruiters, the hackers built rapport by sharing authentic-looking social media profiles and personal photos before conducting a multi-stage interview process.

During a second-round interview conducted via chat, the engineer was instructed to download a coding exercise containing hidden malware onto his work computer. Binance noted in its report:

"The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server".

By late October, the hackers used access from Engineer B's computer to compromise the credentials of Engineer A and a third colleague, Software Engineer C. On October 29th, the attackers logged into Engineer C's machine and moved through internal AI tools to gain control of an internal wallet signing service, allowing them to "initiate transactions outside the normal withdrawal process".

Rafe Pilling, senior director of threat intelligence at cybersecurity firm Sophos, noted that the breach reflects advanced preparation:

“Binance’s account aligns with what we know about the TraderTraitor playbook. The attackers didn’t simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions.”

While Binance did not directly accuse North Korea in its security publication, it pointed to official conclusions issued by federal law enforcement, stating on X:

"The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."

Binance added that its internal security teams had independently detected and blocked 57 separate cyber threats linked to North Korea throughout 2026. The FBI and U.S. Secret Service have tied the heist to the DPRK-backed TraderTraitor group, also known as the Lazarus Group.

North Korean officials rejected the claims on Tuesday. 

Binance confirmed it has set aside company reserves exceeding 100 percent of the lost value to ensure full user coverage. Teng stated that 98 percent of the $6.34 billion in affected token assets have already been replenished, with remaining purchases focused on less liquid tokens. Industry partners including Tether, Circle, and Ripple collaborated to freeze approximately $3 billion of the stolen funds.

Following the incident, Binance has rebuilt its wallet architecture and internal AI tools, decommissioned all affected credentials, expanded security scanning across staff hardware, and engaged independent third-party experts to conduct a full forensic review. The exchange also announced plans to establish a security research fund to develop advanced AI threat detection systems alongside leading cybersecurity firms.