Binance Holdings Ltd. said Tuesday that the hackers behind a $6.3 billion heist used social engineering techniques including fake job interviews, as well as malicious software, in the most detailed report yet on how the incident unfolded.
Binance, which attributed the hack to North Korea, said the breach involved a “sophisticated, multi-stage campaign”. One of the company’s engineers was contacted through a job hunting platform by someone posing as a project director, the exchange said in the report published Tuesday.
They were then interviewed by a person claiming to be the chief executive officer of a fictitious company over a social chat app, and asked to download an assignment containing a “malicious code repository”. This then set off a series of unauthorized activities, the report said.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance. The attackers “combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques.”
Nine days before the hack, attackers tapped the laptop belonging to the employee lured into the fake job interview to infiltrate the computers of two more software engineers who worked on Binance’s digital wallets. The hackers used an “internal AI tool” to gain access, Binance’s report said, without specifying what the tool was or how it was used to gain control of the employees’ laptops.
Read more: Binance’s $6.3 Billion Hack: How Crypto Insurance Works
One of those two engineers had in June accidentally downloaded malicious software in order to install what Binance called “a popular AI coding tool.” In doing so, they had exposed the nature of their role, as well as that of some colleagues who worked on Binance’s wallets to the hacker, according to the report.
The new disclosure on how hackers managed to siphon billions from Binance comes as the exchange — and the crypto industry — attempts to recover from the largest hack in the history of cyberthefts.
The breach deepened a mounting security crisis for a sector already grappling with a wave of cyberattacks. Artificial intelligence is adding to the threat, giving criminals new tools to find weaknesses and deceive employees, and raising the stakes for platforms safeguarding billions of dollars in digital assets.
In the hours after the hack, first reported on Oct. 29, Binance initially said that the attackers may have compromised a software engineer’s laptop, which allowed thieves to withdraw crypto from the exchange. In a subsequent post, the exchange said that the attack was “complex” and the company had “uncovered additional points of breach,” without providing more details.
Shortly after the exploit, traders, cybersecurity professionals, and token issuers all rushed to respond to the fallout. Stablecoin giants Tether and Circle Internet Group Inc., as well as other entities, quickly froze — or stopped hackers from moving — almost $3 billion in funds. Analytics firms raced to track the flow of crypto, eventually attributing the exploit to North Korea, a charge the country has denied. Some traders capitalized on the market turbulence.
Throughout the ordeal, Binance has sought to reassure its users, saying that it will bear the financial cost. Still, the exchange paused withdrawals for almost two days after the incident. Early on Sunday, Binance began to progressively let users take out funds. The company initially saw billions in outflows, but the situation appears to have stabilized and by Tuesday it reported that hourly deposits had started exceeding hourly withdrawals.
Binance has also said that it has almost replenished the cryptocurrency that the hackers had stolen, using a combination of money from its corporate treasury as well as two insurance funds.
The crypto exchange is also working with US law enforcement, including the Federal Bureau of Investigation, the US Secret Service, and the Justice Department. The FBI, which stepped in soon after the hack in Binance’s aid, has also attributed the breach to North Korean hackers.
In 2026, Binance identified and prevented 57 attempted attacks from hackers connected to North Korea, the exchange said in its report detailing the cyber theft. The company has also said that it has implemented various mitigation measures after the hack, including rebuilding the affected crypto infrastructure, redeveloping the internal AI tool, as well as enhancing security scans and an AI-powered detector.
Despite the history-making hack, the market fallout has remained muted. Initially, Bitcoin fell more than 4% after the exploit to nearly $76,000, but the world’s largest cryptocurrency has since pared back some of its losses, trading at around $77,200 on Tuesday.
Photograph: The Binance logo on a laptop arranged in the Brooklyn borough of New York, US, on Wednesday, June 7, 2023; photo credit: Gabby Jones/Bloomberg
Was this article valuable?
Here are more articles you may enjoy.
New Data Centers Projected to Emit More Carbon Than All of Mexico 
Study: 75% of Ex-NFL Players Who Died Between 2008 and 2023 Had CTE 
Private Jet’s Pilot Reported Turbulence Before Florida Crash 
Japan’s Cyberattack Surge Tests Its Push to Strengthen Defenses 
