Binance Reveals $6.3bn Hack Orchestrated Through Fake Job Interviews
Hackers compromised internal AI tools and engineer devices to execute a massive crypto theft.
1Sophisticated Social Engineering Tactics
Binance confirmed that hackers gained system access through a multi-stage campaign targeting internal engineers. The attackers utilized legitimate job-hunting platforms to initiate contact, conducting fake interviews with counterfeit representatives. By sharing social media profiles containing personal images, the perpetrators successfully built trust with the targeted employee before initiating the malicious phase.
2Malware Disguised as Assignments
During a second interview, the engineer was instructed to download a file presented as a professional assignment. This file contained sophisticated malware designed with obfuscation techniques to evade standard security detection. Once executed, the malicious code provided the attackers with a foothold on the engineer's computer, facilitating further unauthorized system access.
3Compromising Internal AI Infrastructure
In October, the attackers leveraged the compromised engineer's device to infiltrate an internal AI tool used by the company. This breach allowed them to gain control over the laptops of two additional engineers. By escalating privileges through these internal systems, the hackers successfully executed the final steps required to drain the exchange's wallets.
4Global Withdrawal Suspension Impact
The security incident forced Binance to suspend all customer withdrawals globally to prevent further asset loss. Users were unable to access their cryptocurrency until the platform restored services on Sunday. Following the reopening, customers withdrew billions of dollars worth of assets, reflecting significant market concern regarding the platform's immediate stability and security.
5Financial Recovery and Replenishment
Binance implemented rapid measures to mitigate the $6.3 billion loss, including working with law enforcement to trace and freeze affected assets. The company confirmed it set aside funds exceeding 100% of the stolen amount. By Saturday, 98% of the impacted token assets had been successfully replenished to cover the losses incurred during the breach.
6Attribution to Lazarus Group
US crime agencies, including the FBI and Secret Service, have identified the incident as bearing the hallmarks of North Korean state-sponsored actors. The Lazarus Group, also known as TraderTraitor, is the primary suspect. While North Korean officials have denied involvement, Binance officially acknowledged the FBI's findings regarding the state's responsibility for the attack.
7Historical Context of Crypto Hacks
This $6.3 billion theft is currently considered the largest cryptocurrency hack in history. It follows a pattern of high-profile breaches, including the $1.5 billion Bybit hack attributed to the same threat actor in 2025. These incidents highlight the evolving nature of cyber threats targeting major exchanges through advanced social engineering and technical exploitation.
8Future Security and AI Strategy
In response to the breach, Binance plans to increase investment in AI-driven threat detection tools. The company will engage third-party cyber experts to conduct a full-scale review of the incident. Additionally, they intend to establish a security research fund and collaborate with leading AI firms to develop targeted initiatives against future sophisticated attacks.
Original article: BBC News — Binance Reveals $6.3bn Hack Orchestrated Through Fake Job Interviews