Binance has disclosed that hackers who stole a record $6.3 billion (£4.7bn) from the world's largest cryptocurrency exchange used fake job interviews and a compromised internal AI tool to carry out the attack.
Initial findings published by the company described the breach as a "sophisticated, multi-stage campaign" involving malicious software downloads that allowed hackers to compromise the computers of Binance engineers and drain billions of dollars worth of cryptocurrency from its wallets.
Binance called it a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened."
According to the company, hackers targeted its engineers using social engineering techniques, including phishing, to trick individuals into revealing sensitive information that could then be used to access their accounts.
One of Binance's engineers was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives. The perpetrators used "more advanced and deceptive" methods to build trust, including sharing social media accounts containing personal images.
During a second interview, the engineer was instructed to download malware disguised as a work assignment. The malicious code used "obfuscation techniques" to evade detection.
Hackers then leveraged the compromised engineer's computer, along with a compromised internal AI tool, in October to gain control over two other engineers' laptops and execute the next stages of the attack.
The incident prompted Binance to suspend withdrawals globally, leaving users unable to access their cryptocurrency until the service was restored on Sunday. Customers withdrew billions of dollars worth of assets after the platform reopened.
"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company said.
Binance stated it had taken a range of steps following the incident, including working with law enforcement to trace and freeze affected assets. It said it had set aside more than 100 percent of the funds needed to cover the loss, with 98 percent of the token assets impacted having been "replenished" as of Saturday.
The $6.3 billion attack is considered the largest cryptocurrency hack on record. US agencies, including the Federal Bureau of Investigation and the Secret Service, have been assisting Binance in tracing the stolen assets.
Those agencies, along with a range of cyber analysts, said the hack bore the hallmarks of having been orchestrated by North Korea, similar to previous breaches attributed to the country.
Pyongyang denied involvement on Tuesday. Kim Yo Jong, a senior official of the Democratic People's Republic of Korea and sister of leader Kim Jong Un, described the accusations as another "sinister attempt" by the United States to damage North Korea's public image. The country has consistently denied responsibility for a number of major cyberattacks it has been blamed for in recent years.
The TraderTraitor unit, also known as the Lazarus Group, was previously blamed for a then-record $1.5 billion hack of cryptocurrency exchange Bybit in 2025.
On Tuesday, Binance addressed the question of North Korean involvement directly, writing on X: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."
As part of its security response, Binance said it would increase investment in AI tools capable of detecting security threats, engage third-party cyber experts to conduct a full-scale review of the incident, establish a security research fund, and work with leading AI and security firms on targeted initiatives.
