Binance says a fake job interview led to its $6.3B hack

Binance says the hackers behind its $6.3bn theft spent five months gaining access to employees’ computers before using an internal AI tool to take control of the exchange’s wallets.

One of the initial breaches came through a fake job interview, according to an incident report Binance published on Tuesday. The findings were reported by Reuters.

The attack began in June, when an engineer on Binance’s wallet team downloaded a compromised developer tool he had found through a search engine.

Binance detected the infection, replaced his computer, and reset his credentials. But the attackers had already gathered information about his responsibilities and the colleagues he worked with.

Their next target was another engineer who was looking for a new job. In September, he received a message on a recruitment platform from someone posing as a project director at a company that did not exist.

After several rounds of interviews, including a video call with the supposed chief executive, he was asked to download a coding test containing malware.

On 20 October, the attackers used the compromised computer, together with an internal AI tool, to gain control of the systems used by two wallet developers.

Nine days later, they used stolen credentials to execute a malicious script against Binance’s wallet-signing service.

Within four minutes, the attackers drained 233.46 million XRP from five hot wallets, which are connected to the internet. They then moved on to other cryptocurrencies, including bitcoin.

“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the report.

North Korea has denied the FBI’s assessment that its TraderTraitor hacking group was responsible for the attack. Binance said it had stopped 57 suspected North Korea-linked threats this year.

Security experts have also warned that such groups may be using AI to carry out crypto thefts.

By 3 November, around $2.85bn of the stolen assets had been frozen or intercepted, according to the report, as cited by BleepingComputer. Binance has pledged to cover all customer losses and maintains that it remains in very strong financial health.

The exchange says it has since rebuilt the affected wallet system and internal AI tool. It also plans to increase investment in AI-based threat detection and establish a security research fund.