Binance says North Korean hackers used a fake job interview and malicious code to compromise an engineer's computer, then used an internal AI tool to steal $6.3 billion in crypto on October 29.
Binance said hackers used a fake job interview to compromise an employee's computer before exploiting an internal artificial intelligence tool to carry out unauthorized transactions in a $6.3 billion cryptocurrency heist.
The attack began in June when an engineer downloaded a malicious Homebrew installation. Binance detected the malware, replaced the device, and rotated affected credentials, but the engineer's role and that of colleagues on the wallet infrastructure team were exposed to the hacker.
In September, another software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. The individual arranged a series of job interviews with a fictitious company. During a live video interview, a fake HR representative shared a social media account with personal photos and videos to build trust. In a second interview on a popular social chat app, someone claiming to be the CEO instructed the engineer to download an assignment containing a malicious code repository. The code executed on the engineer's work computer during setup.
According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. Binance's endpoint security tools did not immediately detect the malware.
On October 20, the attackers used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C. Engineer A had a container deployment permission token on his computer.
On October 29, the attacker accessed Engineer C's computer, used stolen credentials from Engineer A to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.
The FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group. North Korea has rejected the claim.
Binance said it has rebuilt the compromised wallet system and internal AI tool, replaced all affected devices, and decommissioned all credentials and tokens assigned to the compromised engineers. The exchange is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets.
Binance has hired independent cybersecurity experts to conduct a cybersecurity review of the incident and recommend additional protective measures. It is also working to establish a security research fund and initiatives with AI companies and security shops to focus on AI security in blockchain environments.
Binance said it is absorbing the financial impact and will cover all losses. The exchange said it has replenished approximately 90 percent of the stolen assets, covering about $6 billion of the estimated losses. Major cryptocurrencies, including bitcoin, ethereum, tether and BNB, remained fully backed.
Stablecoin giants Tether and Circle Internet Group Inc., as well as other entities, quickly froze or stopped hackers from moving almost $3 billion in funds. Binance temporarily suspended deposits and withdrawals after disclosing the breach and re-enabled them on Saturday.
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in the report.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
Wall Street and Asian and European markets dropped after Democrats' midterm victory raised concerns about tighter scrutiny of AI and data center construction. The Nasdaq fell 5.5% on Thursday, its worst day in 19 months.
Anthropic, PBC has filed a registration statement on Form S-1 with the U.S. Securities and Exchange Commission relating to its proposed initial public offering of Class A common stock.
