Binance says hackers used fake job interviews and malicious software to compromise employees and access its systems before stealing $6.3 billion from the cryptocurrency exchange last week. The company’s investigation found that the attack involved several techniques, rather than a single breach or straightforward phishing attempt.
The FBI attributed the theft to TraderTraitor, a hacking group linked to North Korea, and described it as the largest attack of its kind on record. North Korea denied involvement and called the FBI’s accusation “absurd rhetoric.”
Binance said one of its software engineers downloaded a tampered program in June. The company detected the incident and replaced the engineer’s device, but said the engineer’s role and colleagues connected to its wallet infrastructure team had already been exposed to the attackers.
In September, a second engineer was approached on a job-search platform by someone posing as a project director at a company that did not exist. During an interview, the recruiter shared the engineer’s personal social media photos and videos to build trust, Binance said. In a later interview through a messaging app, a person claiming to be the company’s chief executive asked the engineer to download a recruitment task containing malicious code.
The download went undetected, allowing the attackers to use Binance’s internal artificial intelligence tools to take control of some of the exchange’s systems. Binance said the malware replaced a legitimate component of a development tool with a malicious version, enabling the execution of commands and communication with an attacker-controlled server.
The attackers used the compromised engineer’s laptop and an internal AI tool to control the laptops of the first engineer and a third employee. The first engineer had permission to publish code, which the hackers exploited. On October 29, the attackers accessed the third engineer’s laptop and triggered a malicious script to begin the attack.
Binance said it has since rebuilt its wallet systems and AI tools and is working with external cybersecurity specialists to strengthen its defenses. The company said it has set aside enough resources to cover users’ losses and restored customers’ ability to withdraw funds. It declined to disclose some security measures, saying that revealing them could help attackers plan future incidents.
Binance co-CEO Yi He said the company had detected and neutralized 57 suspected North Korean cyber threats so far in 2026. “We intercepted many of them, but the cost of failing to stop even one was enormous — and this should never have happened,” He said.
Sources: Folha Mercado.