Binance details how a fake job interview helped steal $6.3 billion

Binance lost $6.3 billion in a crypto heist that the company describes as the largest theft of its kind. The exchange published a detailed report this week explaining how attackers executed the scheme over several months using common hacking methods.

The campaign began in June when a developer installed a tampered program. Binance says a malicious Google ad spread the bad installer, which gave attackers early access to engineering details. The company claims its security team found the first infection and replaced the worker's device.

In September, the attackers targeted a different engineer with a fake recruitment process. They held multiple interviews and created social media pages to build trust. The engineer eventually downloaded a file labeled as an interview assignment. This file was malware that replaced a standard software tool with a backdoor version.

Binance states that the malware slipped past endpoint security tools. The attackers then used Binance's internal AI tool to control wallets belonging to the two compromised employees. On October 29, they logged into the third employee's computer to launch the final transfer.

The FBI has identified the group behind the attack as a North Korean unit called TraderTraitor. Binance notes that the delay in stopping the transactions was due to the technical structure of its hot wallets. The system used Multi-Party Computation, which meant there was no single key to revoke the malicious authorizations immediately.

CEO Richard Teng says no user is bearing the financial loss. The company has frozen or intercepted about $2.85 billion of the stolen assets. Teng reported that 98% of the affected tokens have been replenished and withdrawals have broadly resumed.

Binance says it has prevented 57 other suspected North Korea-linked cyber threats. The report does not fully explain why the internal AI tool allowed the attackers to succeed or why the second infection went undetected for so long.