Cryptocurrency exchange Binance has revealed that hackers behind a record-breaking $6.3 billion theft used fake job interviews, malicious software and a compromised internal artificial intelligence tool to infiltrate its systems.
The company said preliminary findings pointed to a sophisticated, multi-stage cyberattack that targeted its engineers and eventually gave the perpetrators access to systems connected to its cryptocurrency wallets.
In a statement, Binance described the incident as a serious security breach and apologised to customers, acknowledging that the attack should never have happened.
Fake recruitment process used to target engineers
According to Binance, the attackers used social engineering tactics to gain the trust of an engineer through a legitimate job-hunting platform.
The employee was invited to what appeared to be genuine interviews with representatives of a company. To make the opportunity seem credible, the hackers reportedly shared social media accounts containing personal photographs and other details.
During a second interview, the engineer was instructed to download what appeared to be an assignment. The file was actually malware designed to install malicious code while using techniques intended to avoid detection.
After compromising the engineer’s computer, the attackers reportedly exploited an internal AI tool that had also been compromised. This allowed them to gain control of two additional engineers’ laptops and advance their attack.
Customer withdrawals suspended
The breach forced Binance to temporarily suspend customer withdrawals worldwide, preventing users from moving their cryptocurrency off the platform until services were restored on Sunday.
Following the reopening, customers withdrew billions of dollars in digital assets.
Binance said it had taken several measures to address the incident, including working with law enforcement agencies to trace and freeze affected funds.
The company also said it had allocated more than 100% of the funds required to cover the losses. As of Saturday, approximately 98% of the affected token assets had been replenished.
North Korea accused of involvement
US authorities, including the Federal Bureau of Investigation and the Secret Service, have been assisting Binance with efforts to trace the stolen cryptocurrency.
Investigators and cybersecurity analysts have pointed to similarities with previous attacks attributed to North Korean hackers.
On Tuesday, Binance cited information released by the FBI, stating that North Korea was responsible for the incident.
Pyongyang rejected the accusation. Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior government official, described the allegations as an attempt by the United States to damage the country’s international reputation.
North Korea has repeatedly denied involvement in major cyberattacks attributed to its hacking networks.
One group frequently associated with such operations is TraderTraitor, also known as the Lazarus Group. It was blamed for the $1.5 billion cryptocurrency theft from exchange Bybit in 2025, which was then considered the largest crypto hack on record.
Binance promises stronger security measures
In response to the breach, Binance says it plans to increase investment in artificial intelligence tools designed to identify and detect security threats.
The exchange will also bring in independent cybersecurity specialists to conduct a comprehensive review of the incident. Additional plans include establishing a security research fund and working with leading AI and cybersecurity companies on targeted security initiatives.
The $6.3 billion incident is believed to be the largest cryptocurrency hack to date, raising renewed concerns about the security of digital asset platforms and the growing sophistication of cybercriminal operations.
The attack also highlights how hackers can exploit human trust and legitimate recruitment processes to gain access to highly sensitive corporate systems.
