Fake Recruitment Interviews Help Hackers Breach Binance in Record $6.3 Billion Crypto Heist

The cryptocurrency industry is facing renewed concerns over cybersecurity after Binance revealed that hackers used fraudulent job interviews, malicious software and compromised employee devices to carry out a theft involving approximately $6.3 billion in digital assets. The exchange said the operation was not a single, isolated breach but a coordinated campaign that developed over several months before attackers gained access to its wallet infrastructure.

In an incident report released on November 3, Binance detailed how the attackers targeted employees responsible for managing its cryptocurrency systems. The operation reportedly began in June and escalated in September, when a software engineer was approached through a legitimate job-hunting platform by individuals posing as representatives of a fictitious company.

Binance co-CEO Richard Teng described the incident as a sophisticated, months-long operation. The company said it was strengthening its security measures and increasing investment in artificial intelligence-based threat detection following the breach.

Fake Job Interviews Used to Infiltrate Employee Systems

According to Binance, the attackers initially gained information about its wallet infrastructure team in June after an employee downloaded a tampered software package while attempting to install an AI coding tool. The company's security team detected suspicious activity, replaced the affected computer and changed the employee's credentials.

However, the attackers had apparently obtained information about the employee's responsibilities and colleagues, giving them an opportunity to target other members of the team.

In September, a different software engineer was contacted through a legitimate recruitment platform by someone claiming to be a project director. The individual arranged an initial interview with a supposed human resources representative, followed by another interview with someone presenting themselves as the chief executive of a fictional company.

The first conversation took place over video, while the second was conducted through a popular messaging application. Binance said the fake recruiters used social media profiles containing personal photographs and videos to establish credibility and make the recruitment process appear genuine.

During the second interview, the engineer was asked to download a coding assignment onto their work computer. The repository contained malicious code that executed during the installation process, allowing the attackers to compromise the device and establish unauthorised access.

Internal AI Tool Allegedly Helped Attackers Expand Access

The investigation revealed that the attackers used the compromised employee's computer alongside an internal AI tool on October 20 to gain access to systems used by two engineers working on Binance's wallet infrastructure.

This stage allowed the attackers to move deeper into the company's internal environment and obtain access to credentials and permissions associated with sensitive systems.

Nine days later, on October 29, the attackers reportedly used stolen credentials from one engineer to access another employee's computer. They deployed a container and triggered a malicious script that enabled unauthorised transactions involving the exchange's cryptocurrency wallets.

The incident highlighted how compromised employee devices, stolen credentials and excessive system permissions can combine to create a serious security vulnerability. It also raised questions about the safeguards required when employees use internal AI tools and other software connected to sensitive corporate systems.

Billions in Cryptocurrency Moved From Binance Wallets

Binance said approximately $6.34 billion worth of cryptocurrency was drained during the attack. The stolen assets included XRP and other digital currencies held in internet-connected wallets, commonly known as hot wallets.

The scale of the theft made it one of the largest cryptocurrency security incidents reported to date. The attackers were able to execute unauthorised transfers before the exchange could fully restrict access to the affected systems.

Binance said it managed to freeze or intercept approximately $2.85 billion of the targeted assets. The company also stated that it had replenished around 98% of the affected customer assets using its own funds, indicating that it intended to absorb the financial impact rather than pass the losses on to users.

The exchange apologised to customers, partners and the wider cryptocurrency industry for the disruption and uncertainty caused by the incident.

FBI Attributes the Attack to North Korea

The Federal Bureau of Investigation has attributed the cryptocurrency theft to North Korea, according to reports surrounding the investigation. North Korean-linked hacking groups have previously been accused by international authorities of targeting cryptocurrency exchanges and blockchain platforms to obtain funds.

However, North Korea has rejected the allegations. Kim Yo-jong, the sister of North Korean leader Kim Jong-un, criticised the US accusations and described them as politically motivated. Pyongyang has repeatedly denied responsibility for major cyberattacks attributed to groups operating from the country.

The attribution remains a contested claim, and the investigation into the incident and the movement of stolen assets continues.

Binance Plans Stronger AI-Based Cybersecurity Measures

Following the breach, Binance said it would increase investment in AI-enabled security systems designed to identify unusual behaviour and suspicious activity across its infrastructure. The company is also working towards establishing a security research fund and developing targeted initiatives with leading AI companies.

The exchange has also indicated that it will strengthen internal access controls, improve monitoring of employee devices and work with independent cybersecurity specialists to examine the incident.

The breach has highlighted the growing importance of employee-focused security measures, particularly as cybercriminals increasingly use recruitment scams and social engineering to target technology professionals. Unlike conventional phishing attempts that rely on suspicious emails or links, fraudulent interviews can involve multiple interactions designed to build trust before delivering malicious software.

A Warning for the Wider Cryptocurrency Industry

The Binance incident demonstrates how cyberattacks can develop over an extended period before resulting in large-scale financial losses. Attackers reportedly used different methods at different stages, beginning with a compromised software installation and later exploiting a fraudulent recruitment process to reach employees with access to critical infrastructure.

For cryptocurrency exchanges and financial technology companies, the incident reinforces the need for strict controls over software downloads, employee devices, authentication credentials and access permissions. Organisations may also need to introduce additional safeguards for employees participating in external recruitment processes, particularly when interviewers request that candidates install unfamiliar applications or coding repositories.

As cryptocurrency platforms continue to expand their use of automation and artificial intelligence, securing internal tools and restricting their access to sensitive systems will remain important challenges. Binance's investigation and subsequent security changes could influence how other exchanges assess insider-access risks and defend against increasingly sophisticated social engineering campaigns.