Binance Says Fake Job Interviews and Compromised AI Tool Enabled $6.3 Billion Hack

The update

Binance has published initial findings on how hackers stole $6.34 billion in the October 29 attack on the world’s largest cryptocurrency exchange. The company said preparations began in June, when an engineer downloaded a tampered developer tool, and continued in September, when attackers posing as recruiters ran fake job interviews and gave another engineer a coding exercise containing hidden malware. From there, the attackers moved through a compromised internal AI tool to reach other engineers’ computers and the system that authorised wallet transactions.

Why it matters

Binance co-CEO Richard Teng told CNBC the attackers spent months building their way in and that there was no single point of failure. Binance said it has replenished 98% of affected assets, set aside more than enough to cover the loss, rebuilt the affected wallet system and AI tool, and replaced compromised devices and credentials. It has also commissioned an independent expert review. The FBI has linked the attack to North Korea’s TraderTraitor group, which North Korea has denied.

What to watch

Watch for the independent review’s findings, whether Binance replenishes the remaining, less liquid assets, and how much of the stolen crypto law enforcement and industry partners can trace and freeze.

Sources

• bbc.co.uk — confirms Binance’s account of the fake interviews, malware download, compromised AI tool and $6.3 billion theft
• cnbc.com — confirms Teng’s account of the June and September intrusions, the 98% replenishment and the independent review

Related coverage

• Binance Customers Withdraw Net $3.64 Billion After Record $6.3 Billion Hack
• Binance Resumes Withdrawals After Record $6.3 Billion Hack
• Revolut Exposes Passports and Crypto Histories to Fake Government Request