Binance reveals fake job interviews helped fuel $6.3 billion heist

Binance Holdings Ltd. released a detailed report on Tuesday confirming that hackers executed a $6.3 billion heist by disguising themselves as recruiters. The company attributed the theft to North Korea, describing the intrusion as a sophisticated campaign that unfolded over several months rather than a single point of failure.

The attackers contacted an engineer through a job hunting platform using the identity of a project director. They then arranged an interview on a social chat app with a person claiming to be the chief executive of a fictional company. During this conversation, the employee was asked to download a file described as an assignment. The report states this file contained a malicious code repository that triggered unauthorized activities on the employee's device.

Richard Teng, co-chief executive officer of Binance, stated that the operation combined fake recruitment interviews with malicious software disguised as legitimate developer tools. He noted that the attackers also utilized compromised devices and artificial intelligence techniques to maintain access.

Nine days before the main exploit, the hackers tapped the laptop of the targeted employee to infiltrate the computers of two other software engineers. These engineers worked specifically on Binance’s digital wallets. The report indicates the attackers used an internal AI tool to gain this access, though the company did not specify the tool's name or its exact mechanism for controlling the laptops.

One of the targeted engineers had previously downloaded malicious software in June while attempting to install a popular AI coding tool. This error exposed the roles of that engineer and colleagues to the hackers. This early compromise provided the threat actors with a map of the wallet infrastructure.

The disclosure arrives as the crypto industry works to recover from the largest hack in the history of cyberthefts. The breach intensified security concerns in a sector already facing a wave of cyberattacks. Artificial intelligence is adding new layers of threat, providing criminals with tools to find weaknesses and deceive employees.

In the hours after the hack was first reported on Oct. 29, Binance said the attackers compromised a software engineer’s laptop to withdraw crypto. Traders, cybersecurity professionals, and token issuers rushed to respond. Stablecoin giants Tether and Circle Internet Group Inc. froze nearly $3 billion in funds to stop the hackers from moving the money. Analytics firms tracked the flow of crypto and attributed the exploit to North Korea, a charge the country has denied.

Binance paused withdrawals for almost two days following the incident. The company began allowing users to take out funds progressively on Sunday. By Tuesday, the exchange reported that hourly deposits had started exceeding hourly withdrawals. Binance has also stated that it has almost replenished the stolen cryptocurrency using money from its corporate treasury and two insurance funds.

The exchange is working with US law enforcement, including the Federal Bureau of Investigation, the US Secret Service, and the Justice Department. The FBI, which assisted Binance soon after the hack, also attributed the breach to North Korean hackers. In 2026, Binance identified and prevented 57 attempted attacks from hackers connected to North Korea.

The company has implemented mitigation measures, including rebuilding affected crypto infrastructure and redeveloping the internal AI tool. It also enhanced security scans and an AI-powered detector. Bitcoin initially fell more than 4% to nearly $76,000 after the exploit but has since pared back some of those losses, trading at around $77,200 on Tuesday.