$6.3 Billion: Binance Details Fake Interviews in Record Crypto Heist
Binance attributed the theft to social engineering and a compromised AI tool, while U.S. agencies point to North Korea.
By Naomi Tesfaye ·
The cryptocurrency exchange Binance has detailed the methods used in the largest digital theft in history, a $6.3 billion loss that has reshaped the security protocols of the world's largest crypto platform.
The firm stated that hackers executed a multi-stage campaign to drain its wallets. Initial findings indicate the perpetrators used malicious software and social engineering to compromise internal systems. The attack resulted in a global suspension of withdrawals, a measure that kept users locked out of their assets until services resumed on Sunday.
Binance described the incident as a serious and highly sophisticated security failure. In a post on X, the company apologized, stating that the breach should not have happened. The report outlines how the attackers targeted specific employees to gain initial access to the network.
One engineer received a contact through a legitimate job-hunting platform. The individual was invited to bogus interviews with fake company representatives who used social media accounts containing personal images to build trust. During a second interview, the engineer was instructed to download malware disguised as an assignment. This software deployed malicious code with obfuscation techniques designed to evade detection.
Following the initial compromise, the hackers used the infected computer and a compromised internal AI tool in October. They gained control over the laptops of two other engineers to execute the next phases of the attack. The company noted that this internal tool was critical to the success of the operation.
The theft has drawn attention to the involvement of North Korea. U.S. crime agencies, including the Federal Bureau of Investigation and the Secret Service, have assisted in tracing the stolen crypto. Analysts believe the hack bears the signatures of the Lazarus Group, a unit also known as TraderTraitor, which was blamed for a $1.5 billion theft from the exchange Bybit in 2025.
Pyongyang denied the accusations on Tuesday. Kim Yo Jong, sister of leader Kim Jong Un, called the claims a sinister attempt by the U.S. to damage the country's public image. Binance cited FBI information indicating the Democratic People's Republic of Korea was responsible for the incident.
Binance has set aside more than 100% of the funds needed to cover the loss. As of Saturday, 98% of the impacted token assets had been replenished. The company is working with law enforcement to freeze remaining assets and plans to increase investment in AI tools for threat detection. It will also establish a security research fund and engage third-party experts for a full review.
