Binance hack: $6.3bn stolen via fake job interviews and compromised AI tool

Binance announced that a sophisticated, multi-stage cyber-attack removed $6.3 billion (about £4.7 billion) from its own wallets, marking the largest crypto theft to date. The exchange said the breach began with a series of fake job interviews that lured an engineer into downloading malware, after which attackers leveraged a compromised internal AI tool to seize control of additional systems.

The attackers used a blend of social-engineering tactics. An engineer was contacted through a legitimate job-search platform and invited to a staged interview with a fictitious company. The attackers built credibility by sharing social-media profiles that appeared authentic and contained personal photos. During a second interview, the engineer was prompted to download a file that appeared to be an “assignment.” The file contained obfuscated malware that bypassed security detection. Once the engineer’s machine was infected, the attackers used the compromised AI tool to gain access to two other engineers’ laptops, enabling them to move further into Binance’s infrastructure and drain the exchange’s wallets.

Binance’s response was swift. The platform suspended all customer withdrawals worldwide, preventing users from accessing their funds until the service was restored on Sunday. After the system reopened, users were able to withdraw billions of dollars worth of assets. Binance apologized for the disruption and uncertainty caused to its users, partners and the broader industry. The company said it had worked with law enforcement to trace and freeze the stolen assets and had set aside more than 100 % of the funds needed to cover the loss, noting that 98 % of the affected token assets had been replenished by Saturday.

U.S. law-enforcement agencies, including the Federal Bureau of Investigation and the Secret Service, have been assisting Binance in tracking the stolen crypto. The agencies, along with cyber-analysts, have indicated that the attack bears the hallmarks of a North Korean operation. In response, Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, dismissed the allegations as a “sinister attempt” by the United States to damage the country’s reputation. The North Korean state has consistently denied responsibility for major cyber-attacks it has been accused of, including the 2025 Bybit breach attributed to the Lazarus Group.

Binance has outlined a comprehensive security strategy to prevent a recurrence. The exchange will increase investment in AI-driven threat detection tools and engage third-party cyber-security experts for a full-scale review of the incident. It also plans to establish a security research fund and collaborate with leading AI and security firms on targeted initiatives.

The incident underscores the growing sophistication of cyber-criminals targeting crypto exchanges and the vulnerabilities that can arise from internal tools and human factors. For founders and operators, it highlights the necessity of robust employee training, strict access controls, and continuous monitoring of internal systems. Investors may see a heightened appetite for security-focused solutions and a push for regulatory frameworks that mandate higher standards of protection. As the industry moves forward, the Binance hack will likely serve as a benchmark for both the scale of potential losses and the depth of response required to restore confidence in digital asset platforms.