Binance has disclosed that the attackers behind a record $6.3bn (£4.7bn) theft from the cryptocurrency exchange got into its systems using fake job interviews and a compromised internal artificial intelligence tool, according to the BBC. The company published initial findings describing a "sophisticated, multi-stage campaign" in which hackers compromised engineers' computers and seized control of tools used to move funds out of its wallets. Binance called the breach a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened."
Why it matters
The $6.3bn haul is believed to be the biggest crypto heist to date, and the details of how it was carried out point to a threat that no amount of code auditing fully addresses: people. According to the BBC, the attackers did not begin with a flaw in Binance's software but with a conversation. The disclosure also matters because of who is accused. US crime agencies, including the FBI and the Secret Service, have been helping Binance trace the stolen assets, and they and a range of cyber analysts have said the breach carries the hallmarks of a North Korean operation, the BBC reports.
How the intrusion unfolded
Binance said in a post on X that its engineers were targeted through social engineering, the broad category of deception that includes phishing and other tricks designed to get people to hand over credentials or access. In this case, one engineer was approached on a legitimate job-hunting platform and invited to interviews with people posing as representatives of a company, according to the BBC.
The company said the perpetrators went further than a typical scam to win the engineer's confidence, including sharing social media profiles containing personal photographs. During a second interview, the engineer was told to download a file presented as an assignment. That file was malware, and the BBC reports it carried code using obfuscation techniques intended to slip past detection.
From that foothold, Binance said, the attackers used the engineer's compromised machine together with a compromised internal AI tool in October to take control of two other engineers' laptops and move on to the next stage of the operation. The BBC describes the result as hackers gaining control of tools used to drain a Binance wallet of billions of dollars in crypto.
The breach forced Binance to halt withdrawals for customers worldwide. Users could not move their cryptocurrency off the platform until the service came back on Sunday. Binance said it apologised "for the concern, disruption and uncertainty it caused our users, partners and the wider industry."
Recovery, reserves and a disputed attribution
Binance said it has worked with law enforcement to trace and freeze affected assets and has set aside more than the full amount needed to cover the loss. According to the BBC, 98% of the impacted token assets had been replenished as of Saturday.
Attention has centred on who was responsible. The FBI and Secret Service, along with cyber analysts, have said the hack resembled earlier breaches attributed to North Korea. Kim Yo Jong, a senior official in the Democratic People's Republic of Korea and the sister of leader Kim Jong Un, dismissed the accusations as another "sinister attempt" by the United States to damage her country's reputation, the BBC reports. North Korea has repeatedly denied responsibility for major cyber attacks blamed on it in recent years. The Lazarus Group, also known as TraderTraitor, was blamed for a then-record $1.5bn hack of the exchange Bybit in 2025.
Binance had not previously answered BBC questions about North Korean involvement. On Tuesday, however, the company wrote on X that "the latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident," as reported by the BBC.
What Binance says it will change
Alongside the apology, Binance outlined steps it says it is taking in response. The company said it will put more money into AI tools built to spot security threats, bring in outside cyber specialists for a full review of the incident, set up a security research fund, and work with leading AI and security firms on focused projects.
Watch for the findings of that independent review and for further word from law enforcement on tracing and freezing the stolen assets.
