Binance has said hackers stole a record $6.3bn (£4.7bn) from the cryptocurrency exchange using fake job interviews, malicious software and a compromised internal AI tool, according to reporting by BBC News (bbc.co.uk). The company published initial findings describing what it called a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened".
The disclosure sets out a campaign that unfolded over several months rather than in a single breach. According to The Guardian (theguardian.com), the operation began with an inadvertent malware download in June, moved to a recruitment scam in September and culminated in a raid on "hot wallets" last week. The Verge (theverge.com) reports that the process started when one developer downloaded a tampered installer apparently spread by a malicious Google ad, exposing details about the engineers and how they work.
How the intrusion progressed
Binance said one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives, according to the BBC. The perpetrators used "more advanced and deceptive" methods to build trust, including sharing social media accounts containing personal images. The engineer was then instructed to download malware masquerading as an "assignment" during a second interview, deploying malicious code with "obfuscation techniques" that evaded detection. The Guardian adds granularity on the sequence: a fake project director contacted a different engineer on a legitimate job-hunting platform, leading to a first-round video interview with a sham HR representative and a second-round interview on a chat app with the "chief executive" of a fictitious company. It was during that second interview that the engineer was tricked into downloading malware. The Verge reports that Binance's security teams did detect the first malware installation in June and replaced the worker's device, but that its tools did not detect the second attack, which deleted the pyenv executable and replaced it with a malicious version giving backdoor access. Binance described the malware as a 0-day that was not detected by endpoint security protection tools at the time, with the attacker taking steps to conceal activity and remove traces of the compromise.The AI tool and the timing of the raid
On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer's system and that of a second wallet developer on the same team, according to The Guardian. On 29 October, the attacker used the second developer's computer with stolen credentials from the first engineer and triggered a malicious script to launch the attack. The BBC reports that hackers leveraged the engineer's compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops. The precise role of the internal AI tool remains the least explained element of the disclosure. The Verge notes there is little detail on the tool and why it was able to help the attackers. That gap matters commercially: firms are widening employee access to internal AI assistants, and the Binance case suggests such tools can become a lateral-movement path if their permissions are not tightly scoped.Containment, losses and the North Korea question
Binance suspended withdrawals for customers globally, with service restored on Sunday, the BBC reports, and customers withdrew billions of dollars worth of assets after it reopened. The Guardian reports that $2.85bn of the $6.34bn drained from cryptowallets had been frozen or intercepted. The Verge quotes chief executive Richard Teng saying no user is bearing the loss, with about $2.85bn in stolen assets frozen or intercepted, and that "at this moment, 98% of impacted tokens had been replenished; we're completing the remaining 2%. Withdrawals have broadly resumed." The BBC reports that Binance said it had set aside more than 100% of the funds needed to cover the loss, noting 98% of the token assets impacted had been "replenished" as of Saturday. The Verge reports that Binance said it had prevented 57 suspected North Korea-linked cyber threat cases. The FBI said on Saturday that North Korea was responsible for the hack, according to The Guardian. The BBC reports that US crime agencies including the FBI and Secret Service have been assisting Binance in tracing the crypto, and that analysts said the breach bore the signs of North Korean involvement. Pyongyang denied the claims. Kim Yo-jong, the sister of leader Kim Jong Un, called the accusations a "sinister attempt" by the US to damage North Korea's public image, the BBC reports, while KCNA quoted her describing the US assertion as "absurd rhetoric and nothing new". Binance subsequently wrote in its post on X that "the latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident", according to the BBC.Why It Matters
The incident reframes two ordinary corporate functions as attack surfaces. Recruitment is now a documented intrusion channel: a legitimate job platform, a plausible recruiter and a downloadable "assignment" were enough to reach engineers with wallet infrastructure access. Internal AI tooling, meanwhile, appears in Binance's own account as part of the attacker's path to other machines. For any firm holding customer assets, the lesson is that access controls around AI assistants and hiring workflows deserve the same scrutiny as perimeter defences.Commercial Impact
Binance's response points to where spending may follow. The BBC reports the company said it would increase investment in AI tools that can detect security threats, engage third-party cyber experts for a full-scale review, establish a security research fund and work with leading AI and security firms. That combination of detection tooling and external review is likely to be replicated by exchanges and custodians facing similar scrutiny. The disclosure also illustrates a containment cost that is hard to model in advance: Binance attributes part of the delay in stopping transactions to the hot wallet's use of Multi-Party Computation, which meant there was no single private key that could immediately revoke the malicious authorisations, according to The Verge.Risks and Unknowns
Several elements remain unresolved. The mechanism by which the internal AI tool assisted the attackers has not been explained in detail. Attribution rests on the FBI's assessment and supporting cyber analysis, and North Korea denies involvement. The recovery figure of $2.85bn frozen or intercepted leaves a substantial balance, though Binance says users are not bearing the loss and that replenishment is nearly complete. Whether regulators will treat AI tool access as a distinct control failure is not yet established by any source in this packet.FY Outlook
The immediate test is whether Binance's promised third-party review produces a public account of the AI tool's role, which would give other operators something concrete to audit against. The broader signal is that social engineering and internal tooling are converging: an attacker no longer needs to break cryptography if a convincing recruiter and an over-permissioned assistant can open the door. Expect hiring-channel verification and AI tool permission scoping to move up security agendas at firms holding customer assets.Sources and References
- BBC News — bbc.co.uk
- The Guardian — theguardian.com
- The Verge — theverge.com
