Binance hackers used fake job interviews and an internal AI tool to steal $6.3bn
A months-long social-engineering operation against Binance engineers, capped by misuse of an internal AI tool, let hackers drain billions from the world's largest crypto exchange.
What happened: Binance says hackers stole $6.34bn from its cryptowallets on October 29 after a months-long infiltration. It began in June when an engineer downloaded a tampered installer while searching for a popular AI coding tool, exposing his identity and that of his wallet-infrastructure teammates. In September, a fake recruiter ran a bogus hiring process with a second engineer that ended with hidden malware in a coding exercise. On October 20, the attacker combined that foothold with Binance's internal AI tool to seize control of two engineers' machines, then used stolen credentials on October 29 to trigger the transaction that drained the wallets. The FBI blames North Korea; Pyongyang calls that absurd.
Why it matters: This wasn't a rushed smash-and-grab. It was a patient, multi-month campaign against one of the best-resourced crypto companies in the world, and it still worked. It also flips a familiar North Korean tactic: instead of its operatives posing as job applicants to get hired, this scheme used a fake job interview to plant malware on a real employee's computer. And it shows that an internal AI tool meant to help staff became a tool the attacker could ride to deeper system access, a new kind of weak point exchanges will now have to defend.
How it works, plainly: June: an engineer tries to install a well-known AI coding tool via a tampered download, unknowingly handing attackers a map of who works on Binance's wallet systems. September: a fake 'project director' runs a two-round interview process with another engineer, ending in a coding test that hides malware. October 20: the attacker pairs that malware with Binance's own internal AI tool to take over that engineer's and a colleague's systems. October 29: stolen credentials are used to launch a malicious script that authorizes the transfer, draining the hot wallets of $6.34bn in assets.
The rollout: Binance has replenished 98% of the stolen funds from its own reserves and pledged to cover all customer losses, while temporarily restricting some withdrawals. With Tether, Circle, Ripple and Coinbase, it has frozen or intercepted about $2.85bn, though some funds are still moving through laundering channels. The company says it has rebuilt the affected wallet system and AI tool, rotated credentials, replaced compromised devices and brought in an independent reviewer. Investigators continue tracing the rest of the funds as the US-North Korea dispute over attribution remains unresolved.