Hackers who stole a record $6.3bn (£4.7bn) from Binance got in by luring one of its engineers into fake job interviews and then turning a compromised internal AI tool against the exchange, the company has said in its first findings on the attack.
Binance, which runs the world’s largest cryptocurrency exchange, described a “sophisticated, multi-stage campaign” in which attackers used malicious software downloads to take over the computers of its engineers and seize control of the tools that drain its wallets. It called the breach a “serious and highly sophisticated security incident” and apologised, saying “this should not have happened”.
It began with social engineering. One engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with people posing as company representatives. Binance said the attackers used “more advanced and deceptive” methods to build trust, including sharing social media accounts filled with personal images. During a second interview the engineer was told to download malware dressed up as an “assignment”, which deployed code with “obfuscation techniques” to avoid detection.
From that machine and from a compromised internal AI tool, the hackers reached two other engineers’ laptops in October and carried out the next stages of the theft. Binance suspended withdrawals for customers worldwide until the service came back on Sunday, after which users pulled billions of dollars worth of assets.
The company said it had set aside more than 100% of the funds needed to cover the loss, with 98% of the affected token assets “replenished” as of Saturday. It is working with law enforcement to trace and freeze stolen assets and the FBI and Secret Service have been helping it track the crypto taken from its wallets. The attack is thought to be the largest crypto theft to date, around four times the previous record, Bybit’s $1.5bn loss earlier in 2025.
US agencies and cyber analysts said the breach bore the signs of North Korea, which Pyongyang denied on Tuesday. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, called the accusations another “sinister attempt” by the US to damage the country’s image. The same unit named here, TraderTraitor, also known as the Lazarus Group, was blamed for the then-record $1.5bn hack of Bybit in 2025.
Binance, which had not previously answered queries about North Korean involvement, wrote on Tuesday: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.” It said it would increase investment in AI tools that detect security threats, bring in third-party cyber experts for a full review, set up a security research fund and work with leading AI and security firms on targeted initiatives.
