Cybersecurity: Binance Details $6.3 Billion Heist via Fake Interviews
North Korean hackers infiltrated the crypto giant through a multi-month social engineering campaign that exploited internal AI tools and compromised developer laptops.
By Sakura Ellis ·
$6.3 billion is the amount Binance Holdings Ltd. lost in what the company described on Tuesday as the most detailed accounting yet of a massive cyber heist. The exchange attributed the theft to a North Korean group that executed a sophisticated, multi-stage campaign over several months.
The operation began with social engineering. An engineer at Binance was contacted on a job hunting platform by an individual posing as a project director. That person then arranged an interview with a fake chief executive of a fictitious company over a social chat application. During the conversation, the engineer was asked to download an assignment containing a malicious code repository.
Richard Teng, co-chief executive officer of Binance, stated that the attackers combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques. He emphasized that the breach was not a single mistake or a single breach, but a campaign built over many months.
Nine days before the main hack, attackers tapped the laptop of the employee who had been lured into the fake interview. They used that access to infiltrate the computers of two other software engineers who worked on Binance’s digital wallets. The report noted that the hackers utilized an internal AI tool to gain this access, though the company did not specify the tool's name or its exact function in the compromise.
One of those two engineers had accidentally downloaded malicious software in June while attempting to install a popular AI coding tool. This error exposed the nature of their role and the roles of colleagues working on the wallets to the hackers. The initial report on October 29 indicated that the attackers may have compromised a software engineer’s laptop, allowing them to withdraw crypto from the exchange.
In the hours following the exploit, stablecoin giants Tether and Circle Internet Group Inc. froze nearly $3 billion in funds to stop the hackers from moving the money. Analytics firms tracked the flow of crypto and attributed the exploit to North Korea, a charge the country has denied. Binance paused withdrawals for almost two days, but began progressively letting users take out funds on Sunday.
By Tuesday, the company reported that hourly deposits had started exceeding hourly withdrawals. Binance said it has almost replenished the stolen cryptocurrency using money from its corporate treasury and two insurance funds. The exchange is working with the Federal Bureau of Investigation, the US Secret Service, and the Justice Department. The FBI also attributed the breach to North Korean hackers.
In 2026, Binance identified and prevented 57 attempted attacks from hackers connected to North Korea. The company has implemented mitigation measures, including rebuilding affected infrastructure and redeveloping the internal AI tool. Bitcoin initially fell more than 4% to nearly $76,000 after the exploit, but it has since pared back losses to trade at around $77,200.
