Binance said Tuesday that hackers used a fake job interview to compromise an engineer’s computer and then abused an internal artificial intelligence tool to seize control of the exchange’s wallets, clearing the way for the theft of $6.3 billion worth of cryptocurrency on Oct. 29. In an initial report into what went wrong, the world’s largest crypto exchange laid out a chain of breaches stretching back to June, in what NBC News reported could be the largest-ever financial heist.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the report.
It Began With a Tampered Coding Tool in June
According to the exchange’s account, the intrusion started not with the wallets themselves but with an advertisement. In June, an employee on Binance’s wallet developer team downloaded an AI tool that had been tampered with, after an advert for the altered version of the coding tool circulated.
Binance said it detected the compromise at the time, replaced the affected device and changed credentials. But the damage was not fully contained: the employee’s role — and the roles of others on the wallet developer team — had already been exposed to the hacker. That reconnaissance gave the attacker a map of which people inside the company sat closest to the systems that move customer funds.
The Fake Job Interview That Opened the Door
The decisive step came in September. A second software engineer who was looking for a new job downloaded what Binance described as a “malicious code repository” onto his computer after interviewing for a role he believed was legitimate. The process included a virtual meeting with the chief executive of a company that did not exist.
That fake job interview — a tactic that targets developers through the ordinary mechanics of hiring, where candidates are routinely asked to download and run code as part of a technical assessment — delivered the attacker a foothold on a machine belonging to someone with access to Binance’s internal environment.
Oct. 20 Takeover of the Wallet Developers’ Systems
On Oct. 20, the attacker combined the compromised computer with an internal AI tool to gain control of the wallet developer’s system, and then of the system belonging to a second wallet developer on the same team, Binance said.
Nine days later, on Oct. 29, the attacker used that second wallet developer’s computer — along with credentials stolen from the first wallet developer — to trigger a malicious script that launched the attack and drained the funds. The sequence, as Binance described it, relied less on breaking cryptography than on stitching together stolen access, human trust and the exchange’s own automation.
The company’s account is reported by NBC News and, in near-identical terms, by MENAFN. Earlier coverage of the incident, including the drained hot wallet and paused withdrawals, traced the immediate market fallout.
FBI Blames North Korean Hackers, Pyongyang Rejects It
The FBI has attributed the theft to a North Korean hacking group. North Korea has rejected that attribution. Binance’s own report does not name the perpetrator; it describes the technical path the intruder took. NarwhalTV previously covered the attribution of the hack to North Korea and the dispute over it.
The scale is what sets the case apart. At $6.3 billion, the loss would rank as the largest-ever financial heist, a sum that dwarfs the biggest bank robberies on record and that was moved out of an exchange in a single operation. Binance has said it is repaying all customers who lost funds through the hack.
What Binance Says It Is Changing
Binance said that as a result of the breach it is increasing investment in AI-enabled detection. The exchange is also working to establish a security research fund and to set up targeted initiatives with leading AI companies.
The response leans on the same technology that features in the attack narrative. By Binance’s own account, an internal AI tool was part of how the attacker escalated access on Oct. 20, and the original June compromise arrived as a tampered AI coding tool. The company’s remedy is to put more AI on the defensive side of that equation, and to fund outside research into the problem.
Why Developer Hiring Is Now an Attack Surface
The two entry points Binance identified share a feature: both arrived through tools and routines engineers use every day. One was an advertised coding utility. The other was a recruitment pipeline complete with a video call and a repository to clone.
Binance’s disclosure also underscores how narrow the targeting was. The June incident did not, on its own, produce a theft — but it told the attacker who on the wallet developer team was worth pursuing. Four months later, a fake job interview aimed at an engineer in that orbit supplied the access that the June breach had not.
Binance has described the report as an initial one, leaving open the possibility of further findings about how the $6.3 billion was moved and where it went.
