The hackers who took a record $6.3bn (£4.7bn) from Binance got in through fake job interviews and a compromised internal AI tool, according to initial findings published by the exchange.
Binance described a “sophisticated, multi-stage campaign” that used malicious software downloads to compromise the computers of its engineers and take control of the tools that could drain its wallets. The company called it a “serious and highly sophisticated security incident” and apologised: “this should not have happened”.
How the first engineer was reached
This is the part worth reading carefully, because it did not require anyone to be foolish.
One Binance engineer was contacted through a legitimate job-hunting platform — not a spoofed site, but a real service people use to find work — and invited to interviews with people posing as company representatives.
Binance said the attackers used “more advanced and deceptive” methods to build trust, including sharing social media accounts containing personal images. In other words they did not merely impersonate a company; they constructed people, with histories.
At a second interview the engineer was instructed to download what was presented as an assignment. It was malware, carrying obfuscation techniques that let the malicious code evade detection.
From one laptop to three
With that machine compromised, the attackers moved sideways. Binance says they used the engineer’s computer together with a compromised internal AI tool in October to gain control of two other engineers’ laptops and carry out the next stages of the attack.
The internal AI tool is the detail that distinguishes this from a conventional breach. A tool of that kind typically has broad access across a company by design, and staff trust its output by habit. It is an unusually effective place for an attacker to stand.
Why a job advert is such good bait
A recruitment approach defeats the instincts that protect people elsewhere. It is expected to arrive unsolicited. It is expected to come from a stranger. It is expected to involve files — a task, a technical exercise, a take-home assignment — and running them is the whole point of the exercise.
And crucially, a job seeker has a strong reason to be cooperative and prompt. Every ordinary warning sign is, in a recruitment context, normal behaviour.
That makes this story relevant well beyond crypto exchanges. For anyone working in software who is approached about a role, the safe rule is simple: never run an interview assignment on a machine that has access to anything that matters. A disposable virtual machine costs nothing.
The aftermath
The breach forced Binance to suspend withdrawals worldwide until service was restored on Sunday, after which customers pulled out billions of dollars in assets. The company says it has set aside more than 100% of the funds needed to cover the loss, and that 98% of the affected token assets had been replenished as of Saturday.
It is working with law enforcement to trace and freeze assets, and says it will increase investment in AI tools for detecting threats, bring in third-party experts for a full review, establish a security research fund, and work with leading AI and security firms.
The attribution dispute
The FBI and Secret Service have been helping trace the funds, and said the hack bore the signs of North Korean orchestration. Binance, which had previously not responded to questions about this, wrote on X: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.”
Pyongyang denied it on Tuesday. Kim Yo Jong, a senior official and sister of leader Kim Jong Un, called the accusations another “sinister attempt” by the US to damage the country’s image. North Korea has consistently denied responsibility for major attacks attributed to it.
The TraderTraitor unit, also known as the Lazarus Group, was blamed for the then-record $1.5bn hack of the exchange Bybit in 2025.
