Binance Says Fake Job Interview and Internal AI Tool Enabled $6.3 Billion Hack

The attack, which could be the largest financial heist on record, culminated on October 29. Binance's report describes a sequence of breaches stretching back to June. In a statement quoted by The National, the company said the attackers "combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method".

How the Attack Unfolded

According to the report, as summarised by Reuters and published by Khaleej Times, the campaign began in June when a member of Binance's wallet developer team downloaded a tampered version of an AI coding tool that had been advertised online. Binance detected the problem, replaced the device and changed credentials. However, the employee's role, and those of others on the wallet team, had already been exposed to the attacker.

In September a second software engineer who was looking for a new job downloaded a malicious code repository after interviewing for what he believed was a real position. The process included a virtual meeting with the chief executive of a company that turned out not to exist.

On October 20 the attacker used that compromised computer, together with an internal Binance AI tool, to take control of the system of one wallet developer and then a second developer on the same team. The National reported that Binance described this as the springboard for the attack. On October 29 the attacker used the second developer's computer and credentials stolen from the first to trigger a malicious script that drained the funds.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in the report.

Attribution and Response

The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored hacking unit, carried out the attack. North Korea has rejected the claim. The FBI said law enforcement had seen members of the group converting the stolen assets into ether, and that it expected further laundering.

Binance has said it will absorb the losses rather than pass them on to customers, and that it is repaying everyone who lost funds. Earlier this week it described its financial health as very strong.

The company said it has rebuilt the affected wallet system in a new environment, rebuilt its internal AI tools and access controls, replaced affected devices, and decommissioned the credentials and tokens linked to the engineers involved. It also said it is increasing investment in AI-enabled detection and is working to set up a security research fund and targeted initiatives with leading AI companies.

Why It Matters

For security and technology leaders, the report shows how AI tools can widen the attack surface. Two of the entry points were AI-related: a tampered AI coding tool used to profile the wallet team, and an internal AI tool the attacker used to move from one compromised laptop into the systems that controlled customer funds. Internal assistants and agents that can reach sensitive systems on an engineer's behalf can do the same for an intruder who holds that engineer's machine.

The fake recruitment process follows a pattern that security researchers have long linked to North Korean groups targeting developers in crypto and technology companies. Because a job seeker may run code on a work device as part of a supposed hiring test, the risk sits outside many companies' standard controls.

Bloomberg called the document the most detailed account yet of how the incident unfolded. The New York Times described it as a months-long campaign. Binance has called the report initial, so more findings may follow.