Binance says fake job interviews used as part of $6.3bn crypto hack

What the report says

Binance says hackers behind a record $6.3 billion crypto theft used a mix of social engineering and technical compromise to get into its systems. According to the company’s initial findings, one engineer was approached through a legitimate job-hunting platform and drawn into fake interviews with people posing as company representatives. Binance said the attackers then persuaded the engineer to download malware disguised as an assignment, allowing them to take over devices and move deeper into its network.

The exchange, which runs the world’s largest cryptocurrency platform, said the intrusion formed part of a “sophisticated, multi-stage campaign” that also involved a compromised internal AI tool. Binance said the attackers used the engineer’s infected computer to reach two other engineers’ laptops and then carried out the steps needed to drain funds from Binance wallets. The company suspended withdrawals globally after the incident and later restored service, with customers withdrawing billions once access reopened.

Binance has apologised for the disruption and said it is working with law enforcement to trace and freeze assets linked to the hack. It also said it had set aside more than the amount needed to cover losses and had replenished most of the affected token assets. The company said it will expand investment in AI-based security tools and bring in outside cyber experts to review what happened.

US agencies including the FBI and Secret Service have been helping investigate, and cyber analysts have said the attack bears hallmarks previously associated with North Korea. North Korea has denied involvement. That wider attribution debate matters because the hack highlights how cryptocurrency firms can be targeted through both human deception and software compromise, not just direct system attacks.