OMM Newsroom
Hackers behind a record $6.3bn (£4.7bn) theft from “Binance” used fake job interviews and a compromised internal artificial intelligence tool, the cryptocurrency exchange said in initial findings reported by the BBC.
“Binance”, which operates the world’s largest cryptocurrency exchange, said the attackers gained access to its systems through a “sophisticated, multi-stage campaign”. The hackers used methods including malicious software downloads to compromise engineers’ computers and take control of tools used to drain billions of dollars in cryptocurrency from the company’s wallets.
The company described the incident as “serious and highly sophisticated” and apologised, saying: “This should not have happened.”
In a post on “X”, “Binance” said the attackers used social engineering to target its engineers. Such tactics include phishing, in which people are tricked into revealing sensitive or personal information that could be used to access their accounts.
One engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with people posing as company representatives, “Binance” said. The attackers used “more advanced and deceptive” methods to build trust, including sharing social media accounts containing personal images.
During a second interview, the engineer was told to download malware disguised as an “assignment”. The malicious code used “obfuscation techniques” to evade detection, the company said.
In October, hackers used the compromised computer and an internal AI tool to gain control of two other engineers’ laptops and carry out further steps in the attack, according to “Binance”.
The incident prompted the exchange to suspend customer withdrawals worldwide. Users could not withdraw cryptocurrency until the service was restored on Sunday. Customers withdrew billions of dollars’ worth of assets after withdrawals reopened.
“We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company said.
“Binance” said it had worked with law enforcement to trace and freeze affected assets and had set aside more than 100% of the funds needed to cover the loss. As of Saturday, 98% of the affected token assets had been “replenished”, it added.
The $6.3bn (£4.7bn) attack is thought to be the largest cryptocurrency hack to date.
North Korea denies involvement
US agencies, including the Federal Bureau of Investigation and the Secret Service, have been helping “Binance” trace cryptocurrency taken from its own wallets.
The agencies and a number of cyber analysts said the hack bore signs of being orchestrated by North Korea, as did similar breaches. Pyongyang denied responsibility on Tuesday.
Kim Yo Jong, a senior North Korean official and the sister of leader Kim Jong Un, described the accusations as another “sinister attempt” by the US to damage the country’s public image. North Korea has repeatedly denied responsibility for major cyberattacks it has been blamed for in recent years.
The TraderTraitor unit, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of cryptocurrency exchange “Bybit” in 2025.
“Binance” had previously not responded to the BBC’s questions about North Korea’s alleged involvement. On Tuesday, however, the company said in its post on “X”: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.”
“Binance” said it would increase investment in AI tools to detect security threats and hire third-party cyber experts to conduct a full-scale review of the incident. It also said it would seek to establish a security research fund and work with leading AI and security firms on targeted initiatives.
