Binance Says Fake Job Interviews Helped Hackers Pull Off a $6 Billion Crypto Heist

Binance said bogus job interviews were among the methods hackers used before the October 29 theft of $6.3 billion in crypto. The company described the incident as part of a months-long campaign targeting its wallet systems. Binance CEO Richard Teng called it one of the most sophisticated attacks the digital asset industry has seen.

The FBI has said North Korean hackers were behind the theft, while North Korea has denied involvement. Binance said no user bears the loss and that withdrawals had broadly resumed.

According to Binance, one software engineer was contacted in September through what the company described as a legitimate job-hunting platform by someone posing as a project director. The process included a first-round interview with a fake HR representative and a second interview with a person claiming to be the CEO of a fictitious company.

Binance said the fake HR representative used a social media account with personal photos and videos to build trust. During the second interview, the engineer was told to download an assignment that contained a malicious code repository onto a work computer.

Binance said the operation began in June, when an engineer on its wallet infrastructure team downloaded a tampered version of an AI coding tool. The company said its security team detected the issue, replaced the device, and changed related credentials, but employee roles were exposed to hackers.

On October 20, Binance said hackers used a compromised computer and an internal AI tool to gain control of systems used by two other engineers on the wallet team. On the day of the heist, Binance said the attacker used stolen credentials, deployed a container, and triggered a malicious script to launch the attack.

Binance said about $2.85 billion had already been frozen or intercepted with help from law enforcement, issuers, and blockchain intelligence firms. Teng said 98% of impacted tokens had been replenished and that Binance was completing the remaining 2%.

The company said it is bringing in third-party cybersecurity experts to further review the incident. It also said it is increasing investment in AI-enabled detection and working to establish a research fund with AI companies focused on AI security in blockchain systems.