Binance says hackers used fake job interviews and an internal AI tool in $6.3 billion theft

Crypto exchange Binance has explained how the largest cryptocurrency theft to date, put at $6.3 billion, was carried out. A postmortem from the company says attackers combined familiar hacking techniques over a period of months. It matters because it shows how social engineering can compromise even a major crypto platform.

How the attack unfolded

According to Binance, it began in June when a developer downloaded a tampered installer. The infection apparently spread through a malicious Google ad and exposed details about the engineers and how they work. In September, another engineer was approached by someone posing as a prospective employer. The person arranged calls and several rounds of interviews, shared social media pages to build trust, and finally got the engineer to download a fake interview assignment that was actually malware.

Binance says its security teams detected the June infection and replaced the worker's device. Its security tools did not detect the second attack, however. That malware replaced the pyenv development tool component with a malicious version, giving the attackers backdoor access.

Wallet access and the theft

By October 20, the attackers, whom the FBI has identified as a North Korean unit called "TraderTraitor," used Binance's own internal AI tool to gain control over wallets belonging to the engineer compromised in June and a third employee. On October 29 they logged into the third employee's computer and launched the attack.

Binance explains that it could not stop transactions that occurred nearly two hours after the first unauthorized transfers because its hot wallet used Multi-Party Computation (MPC), so no single private key existed to immediately revoke the malicious EIP-7702 authorizations.

CEO Richard Teng writes that no user is bearing the loss. About $2.85 billion in stolen assets has been frozen or intercepted, 98% of impacted tokens have been replenished, and withdrawals have broadly resumed. The exchange also says it has prevented 57 suspected North Korea-linked cyber threat cases.

It remains unclear why this attack worked, since the danger of job interviews that require downloading code has been warned about for years. Little is known about the internal AI tool or why it helped the attackers.